WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.0. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...

CVE-2021-24960

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks...

PT-2022-16566

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0 Description The issue is related to an authenticated unrestricted file upload vulnerability. This vulnerability is exploited via the AdminFileTransferServlet component. Recommendations For Extensis Portfolio...

WordPress azw woocommerce file uploads plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress azw woocommerce file uploads plugin versions = 1.0.1. Solution No patched version available...

WordPress azw woocommerce file uploads plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress azw woocommerce file uploads plugin versions = 1.0.1. Solution No patched version available...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

WordPress Protect Uploads with Login – Protect Your Uploads plugin <= 1.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Protect Uploads with Login – Protect Your Uploads plugin versions = 1.8. Solution No patched version available...

WordPress Protect Uploads with Login – Protect Your Uploads plugin <= 1.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Protect Uploads with Login – Protect Your Uploads plugin versions = 1.8. Solution No patched version available...

Security fix for the ALT Linux 10 package python3-module-django version 3.2.12-alt1

3.2.12-alt1 built Feb. 25, 2022 Anton Farygin in task 295709 Feb. 20, 2022 Anton Farygin - 3.2.11 - 3.2.12 - Fixes for the following security vulnerabilities: + CVE-2022-22818: Possible XSS via % debug % template tag. + CVE-2022-23833: Denial-of-service possibility in file uploads...

Zfaka 代码问题漏洞

An input validation error vulnerability exists in Zfaka, a free, secure, stable and efficient card issuance system, which stems from the product's backend file upload function that does not validate files. An attacker could cause remote command execution through this vulnerability...

CVE-2022-24984

Forms generated by JQueryForm.com before 2022-02-05 if file-upload capability is enabled allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content...

Bbs Forum 代码问题漏洞

Bbs Forum Patrol Cloud Light Forum System is a forum system. A code issue vulnerability exists in BBS Forum, which originates from the product's getType function not performing security checks on uploaded files. An attacker can use this vulnerability to upload arbitrary files. The following...

CVE-2020-13675

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the si...

Projeqtor 安全漏洞

Projeqtor is a PHP-based open source project management software from the Projeqtor community. The software is used to organize various functions required for multiple projects and is suitable for IT projects. A cross-site scripting vulnerability exists in Projeqtor 9.3.1 that allows an attacker ...

Apache Cayenne 代码问题漏洞

Apache Cayenne is the United States Apache Apache Foundation of an open source persistence framework licensed under the Apache license . Used to provide object-relational mapping and teleprocessing services. An input validation error vulnerability exists in Apache Cayenne because the product does...

Unrestricted Uploads in Concrete5

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value...

GHSA-G4GM-PXH3-29FQ Unrestricted Uploads in Concrete5

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value...

CVE-2021-44912

In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is...

XpressEngine 跨站脚本漏洞

XpressEngine XE is a CMS Content Management System that allows anyone to publish content easily, conveniently and freely. With an open source license, anyone can use or modify it, and as an open project, anyone can participate in its development. XE suffers from a security vulnerability that stem...