CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

WonderCMS 安全漏洞

WonderCMS is an open source PHP-based content management system CMS from WonderCMS Inc. A security vulnerability exists in WonderCMS version 3.4.3, which stems from an arbitrary file upload vulnerability in the uploadFileAction function, allowing an attacker to execute arbitrary code via a crafte...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

WordPress Business Card Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software Business Card Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2024-5807 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID a6a458d61852 Credits Anjo Rev Tingson Required privilege...

CVE-2024-41304

The CVE-2024-41304 entry refers to WonderCMS v3.4.3 and reports an arbitrary file upload vulnerability in the uploadFileAction() function. A crafted SVG file can lead to arbitrary code execution on affected installations. Connected sources consistently describe the same issue without detailing ex...

GHSA-G872-JWWR-VGGM Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Description: Remote Code Execution Vulnerability has been identified in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL admidiobaseurl/admmyfiles/messagesattachments/filename. Th...

WordPress Media.net Ads Manager plugin <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Media.net Ads Manager versions = 2.10.13...

WordPress Media.net Ads Manager Plugin <= 2.10.13 is vulnerable to Arbitrary File Upload

Software Media.net Ads Manager Type Plugin Vulnerable versions = 2.10.13 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6431 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 89eb205a9ac8 Credits István Márton Required privilege...

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Description: Remote Code Execution Vulnerability has been identified in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL admidiobaseurl/admmyfiles/messagesattachments/filename. Th...

CVE-2024-6431 Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2024-6431 Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-lev...

PT-2024-37621 · WordPress · Media.Net Ads Manager

Name of the Vulnerable Software and Affected Versions: Media.net Ads Manager plugin for WordPress versions up to, and including, 2.10.13 Description: The issue arises from missing file type validation and a missing capability check in the sendMail function, allowing authenticated attackers with...

WordPress plugin Media.net Ads Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-40318

An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file...

GHSA-P528-3MVF-GR87 Remote code execution in Spring Cloud Data Flow

In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server...

Webkul QloApps 安全漏洞

Webkul QloApps is a hotel reservation management software from Webkul Inc. A security vulnerability exists in Webkul QloApps version 1.6.0.0, which originates from an arbitrary file upload vulnerability. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially...

PT-2024-28804 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: Webkul Qloapps version 1.6.0.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file, due to an arbitrary file upload vulnerability. Recommendations: For Webkul Qloapps version 1.6.0.0, update to a...

CVE-2024-40318

An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-40318

CVE-2024-40318 is an arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 that enables remote code execution. The root cause involves bypassing file upload restrictions via crafted uploads, with the Red Hat/NVD OSV entries and PT Security notes corroborating a code-execution outcome. Im...