CVE-2024-9932

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-9932 Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-9932

CVE-2024-9932 affects the WordPress plugin “Wux Blog Editor” up to version 3.0.0. The root cause is inadequate file type validation in the wuxbt_insertImageNew function, enabling unauthenticated users to upload arbitrary files to the server and potentially achieve remote code execution. Publicly ...

CVE-2024-37847

An arbitrary file upload vulnerability in MangoOS before 5.1.4 and Mango API before 4.5.5 allows attackers to execute arbitrary code via a crafted file...

CVE-2024-48450

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group...

CVE-2024-48448

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker comments page...

WordPress Wux Blog Editor plugin <= 3.0.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Wux Blog Editor versions = 3.0.0...

WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin AR For WordPress versions = 6.6...

WordPress Plugin Propagator plugin <= 0.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Plugin Propagator versions = 0.1...

WordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Sudan Payment Gateway for WooCommerce versions = 1.2.2...

WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Automatic Translation versions = 1.0.4...

WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Multi Purpose Mail Form versions = 1.0.2...

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Woocommerce Product Design versions = 1.0.0...

WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Marketing Automation by AZEXO versions = 1.27.80...

WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by CTRL - Chance Patchstack Alliance in WordPress Plugin Ajar in5 Embed versions = 3.1.3...

CVE-2024-48450

CVE-2024-48450 affects Huly Platform v0.6.295. The issue is an arbitrary file upload vulnerability that enables an attacker to execute arbitrary code by uploading a crafted HTML file into a chat group. The available documents do not provide details on root cause beyond the upload mechanism, affec...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50482 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 410808c7ca79 Credits Bonds Required privilege...

CVE-2024-48448

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker comments page...

WordPress Plugin Propagator Plugin <= 0.1 is vulnerable to Arbitrary File Upload

Software Plugin Propagator Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50495 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 8034c466a94c Credits stealthcopter Required privilege...

CVE-2024-37847

The CVE-2024-37847 entry documents an arbitrary file upload vulnerability affecting MangoOS before 5.1.4 and Mango API before 4.5.5, enabling arbitrary code execution via a crafted file. Affected components: MangoOS and Mango API (versions prior to listed fixes). Root cause: improper handling of ...