CVE-2020-5505: Improper Neutralization of Special Elements used in an OS Command

Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring in conjunction with "type":"application/x-php" to the /api/files/ URI...

PT-2020-18485

Name of the Vulnerable Software and Affected Versions Freelancy version 1.0.0 Description The issue allows remote command execution via a specific substring in the "file" parameter, in conjunction with the "type" parameter set to "application/x-php", when sent to the "/api/files/" API endpoint...

Freelancy 1.0.0 Remote Code Execution

Exploit Title: Freelancy - Freelance Management App v1.0.0 - RCE Authenticated Arbitrary File Download Date: 03-01-2019 Exploit Author: Ismail Tasdelen Vendor Homepage: https://vaaip.com/ Software Link: https://codecanyon.net/item/freelancy-freelance-project-management-application/25288636...

Elasticsearch files access

snapshot API files access...

CVE-2013-4302

1 ApiBlock.php, 2 ApiCreateAccount.php, 3 ApiLogin.php, 4 ApiMain.php, 5 ApiQueryDeletedrevs.php, 6 ApiTokens.php, and 7 ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the...