9430 matches found
Craft CMS 2.7.9/3.2.5 - Information Disclosure
Exploit Title : CraftCms Users information disclosure From uploaded File Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 20-07-2019 Vendor Homepage:https://craftcms.com...
CVE-2018-21007
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...
Design/Logic Flaw
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...
CVE-2018-21007
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...
CVE-2017-18592
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wpupload directory for file uploads...
CVE-2017-18592
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wpupload directory for file uploads...
CVE-2017-18592
The CVE-2017-18592 vulnerability affects the WordPress plugin woocommerce-catalog-enquiry (versions older than 3.1.0). The issue is an incorrect wp_upload directory used for file uploads, enabling an improper file placement path. Related sources describe this as an Arbitrary File Upload risk, wit...
WordPress wp-file-upload plugin code issue vulnerability (CNVD-2019-30990)
WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-file-upload is a file upload plugin used in it. A code issue vulnerability exists in the WordPress wp-file-upload plugin,...
WordPress wp-file-upload plugin code issue vulnerability
WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-file-upload is a file upload plugin used in it. A code issue vulnerability exists in the WordPress wp-file-upload plugin,...
Malicious Package
bb-builder is a malicious package. The package could run an executable targeting Windows and upload information to a remote server. Additionally an outside entity may gain full control of the computer via exploiting this malicious package...
PT-2019-7298
Name of the Vulnerable Software and Affected Versions wp-file-upload plugin versions prior to 2.7.1 Description The issue is related to insufficient restrictions on the upload of .js files. Recommendations For versions prior to 2.7.1, update to version 2.7.1 or later to resolve the issue...
CVE-2019-15127
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file...
CVE-2019-15104
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...
PT-2019-4451
Name of the Vulnerable Software and Affected Versions SAP Enable Now versions prior to 1902 Description The issue is related to the XML parser used by SAP Enable Now, which has not been properly hardened, leading to a Missing XML Validation vulnerability. This vulnerability affects file uploads a...
CVE-2019-14794
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...
CVE-2019-14794
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...
Design/Logic Flaw
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...
CVE-2019-14794
CVE-2019-14794 affects the WordPress Meta Box plugin prior to version 4.16.2. The vulnerability arises from mishandling file uploads to custom folders, with a CVSS3 base score of 7.5 (network/vector, low access complexity, no privileges required, integrity impact HIGH). Public exploitation detail...
PT-2019-13823 · Backdrop · Backdrop Cms
Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.12.x through 1.12.7 Backdrop CMS versions 1.13.x through 1.13.2 Description: The issue allows the upload of entire-site configuration archives through the user interface or command line, without sufficiently checking...