CVE-2023-5601 WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload

The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE...

Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload

Description The plugin allows forum administrators, who may not be WordPress super-administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files e.g. .php, .phtml, potentially leading to remote code execution. Any user who has the rights to modify the...

Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload

Description The plugin allows forum administrators, who may not be WordPress super-administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files e.g. .php, .phtml, potentially leading to remote code execution. PoC Any user who has the rights to modify t...

CVE-2023-41357 Galaxy Software Services Vitals ESP - Arbitrary File Upload

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...

Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons

WP-CVE-2023-5360 Royal Elementor Addons and Templates Pyt...

CVE-2023-5860

The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload...

WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.7.3 is vulnerable to Arbitrary File Upload

Software Drag and Drop Multiple File Upload – Contact Form 7 Type Plugin Vulnerable versions = 1.3.7.3 Fixed in 1.3.7.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5822 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID f6819936ca80 Credits...

WordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload

Software Icons Font Loader Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5860 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e7c1b6cac566 Credits Alex Thomas Required privilege...

CVE-2023-46428

An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-46428

An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-46428

An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file...

HadSky Code Issues Vulnerabilities

HadSky is an original open source php light forum system from China's HadSky company. A security vulnerability exists in HadSky version v7.12.10, which stems from an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code via a crafted file...

PT-2023-30024 · Hadsky · Hadsky

Name of the Vulnerable Software and Affected Versions: HadSky version 7.12.10 Description: An arbitrary file upload issue allows attackers to execute arbitrary code via a crafted file. Recommendations: For HadSky version 7.12.10, update to a version that fixes this issue to prevent arbitrary code...

CVE-2023-46428

An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-46428

An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file...

Cisco Identity Services Engine Security Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The ISE collects real-time information about the network, users, and devices to formulate and enforce policies to regulate the network. A security vulnerability exists in the Cisco Identit...

CVE-2023-46428

CVE-2023-46428 affects HadSky v7.12.10. The issue is an arbitrary file upload vulnerability in HadSky’s upload handling that allows an attacker to execute arbitrary code via a crafted file. The vulnerability is described consistently across multiple sources (NVD, Red Hat, PRION, PT Security), wit...

flusity CMS Arbitrary File Upload Vulnerability

flusity CMS is a user interaction interface solution that you can easily change or add code to. Flusity CMS suffers from an arbitrary file upload vulnerability that stems from the lack of validation of the uploaded file in the handleFileUpload function in core/tools/upload.php with the parameter...

CVE-2023-5820

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged reques...

Multiple vulnerabilities in baserCMS

Overview baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-29009 Reflected cross-site scripting vulnerability CWE-79 - CVE-2023-43647 Directory traversal vulnerability CWE-22 - CVE-2023-43648...