14791 matches found
CVE-2024-24059
Springboot-manager v1.6 is affected by an Arbitrary File Upload vulnerability caused by not filtering uploaded file suffixes. The reports consistently describe this as the root cause and outline the resulting security impact as arbitrary file upload with low confidentiality/integrity impact and n...
CVE-2024-24059
springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...
CVE-2023-31505
An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file...
CVE-2024-1069
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'viewpage' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to uploa...
CVE-2023-31505
An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file...
CVE-2023-31505
An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file...
WordPress is vulnerable to Arbitrary File Upload
Software WordPress Type WordPress Core Vulnerable versions 6.4.3 Fixed in 6.4.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2018-14028 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 87a72ffd6c73 Credits Vinicius Marangoni Required privilege...
Contact Form Entries < 1.3.3 - Admin+ Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to insufficient file validation on the 'viewpage' function, allowing authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code...
WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload
Software Icons Font Loader Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-24714 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 8add145a8567 Credits Vulzap Required privilege Administrator...
WordPress plugin Contact Form Entries Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...
WordPress Contact Form Entries Plugin <= 1.3.2 is vulnerable to Arbitrary File Upload
Software Contact Form Entries Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-1069 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 192b96d23fe0 Credits István Márton Required privilege...
Avada < 7.11.2 - Contributor+ Arbitrary File Upload
Description The theme is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaximportoptions' function, making it possible for authenticated attackers with contributor permissions to upload arbitrary files on the affected site's server which may make remote code...
YonBIP File Upload Vulnerability in UFIDA Network Technology Co.
YonBIP is a new generation of products developed by UFIDA, as the world's leading enterprise digital intelligence platform and application software. A file upload vulnerability exists in YonBIP, which can be exploited by an attacker to upload arbitrary files and execute arbitrary code in the...
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Description The theme is vulnerable to arbitrary file uploads due to missing file type validation when extracting zip files in the 'processupload' and 'regenerateiconfiles' functions. This makes it possible for authenticated attackers with author permissions to upload arbitrary files on the...
Progress WS_FTP Server < 8.7.6, 8.8.x < 8.8.4 Arbitrary File Upload
The remote host is running a version of WSFTP earlier than 8.7.6 or 8.8.x prior to 8.8.4. It is, therefore, affected by an arbitrary file upload vulnerability in the Ad Hoc Transfer Mode module. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload...
Thruk Path Traversal Vulnerability
Thruk is an open source multi-backend monitoring web interface from the individual developer Sven Nierlein in Germany. A path traversal vulnerability exists in versions prior to Thruk 3.12, which stems from a vulnerability that allows an attacker to arbitrarily upload files to any path on the...
LeptonCMS Arbitrary File Upload Vulnerability
LeptonCMS is a content management system CMS for the Lepton Project. An arbitrary file upload vulnerability exists in LeptonCMS version v7.0.0, which stems from the application's lack of effective authentication of uploaded files. An authenticated attacker can exploit this vulnerability to execut...
PT-2024-19964 · Unknown · Parisneo/Lollms-Webui
Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: A vulnerability in parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. The issue resides in the install...