OpenEMR 代码问题漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A code issue vulnerability exists in versions prior to OpenEMR 7.0.0.2 that stems...

CVE-2022-3982

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE...

CVE-2022-3989

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

CVE-2022-3912

The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example...

CVE-2022-3921

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE...

WordPress plugin User Registration 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

WordPress theme Listingo 代码问题漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A code issue vulnerability exists in WordPress theme Listingo versions prior to 3.2.7 that stems from not...

PT-2022-24810 · WordPress · Listingo

Name of the Vulnerable Software and Affected Versions: Listingo WordPress theme versions prior to 3.2.7 Description: The issue concerns the lack of file validation for uploads via an AJAX action that is accessible to unauthenticated users. This could allow attackers to upload arbitrary files,...

django: Denial-of-service possibility in file uploads

A flaw was found in Django. The issue occurs when passing certain inputs to multipart forms, resulting in an infinite loop when parsing files...

django: Denial-of-service possibility in file uploads

A flaw was found in Django. The issue occurs when passing certain inputs to multipart forms, resulting in an infinite loop when parsing files...

FeMiner wms 代码问题漏洞

FeMiner wms is a repository management system for individual developers of the Chinese front-end miner FeMiner. A security vulnerability exists in FeMiner wms, which stems from some unknown functionality in the file /product/savenewproduct.php?flag=1, where the operation of the parameter upfile...

House Rental System 代码问题漏洞

House Rental System is a rental management system that allows you to add, modify and delete listings and to place reservations. A security vulnerability exists in House Rental System due to unknown functionality in the component POST request handler file tenant-engine.php, where the operation of...

Human Resource Management System 代码问题漏洞

Human Resource Management System is a human resource management system by maverickosama Personal Developer. A security vulnerability exists in Human Resource Management System version 1.0 due to some unknown handling of the file /hrm/controller/employee.php in the component Content-Type Handler,...

CVE-2022-3226

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA...

PT-2022-5774 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: The issue allows for OS command injection, enabling the execution of code via SSL VPN configuration uploads. This can be exploited by a remote attacker to execute arbitrary code...

Event Registration System 代码问题漏洞

Event Registration System is an event registration system with QR codes by Carlo Montero Personal Developer. A security vulnerability exists in the Event Registration System version 1.0, which stems from an incorrect manipulation of the parameter cmd leading to unrestricted file uploads...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

Tiny File Manager 安全漏洞

Tiny File Manager is a web-based open source file manager. A security vulnerability exists in Tiny File Manager version 2.4.8, which originates in its server-side processing of uploaded files instead of returning files for download, which allows unauthenticated users to access uploaded files via...

CVE-2022-44748

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

CVE-2021-43258

CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores...