CVE-2023-4861

The CVE-2023-4861 entry affects the WordPress plugin File Manager Pro (vulnerable:

CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE...

CVE-2023-35018

IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382...

WordPress plugin File Manager Pro Code Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload

Description The plugin does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE. Make sure to have both WooCommerce and NinjaForms 3.4.34.2 NF's latest version on the 3.4 branch installed, then follow those instructions:...

WordPress Royal Elementor 1.3.78 Shell Upload

Today, on October 13, 2023, the Wordfence Threat Intelligence Team became aware of a vulnerability that was recently patched in Royal Elementor Addons and Templates, a WordPress plugin installed on over 200,000 sites, that makes it possible for unauthenticated attackers to upload arbitrary files ...

WordPress WooCommerce Ninja Forms Product Add-ons Plugin <= 1.7.0 is vulnerable to Arbitrary File Upload

Software WooCommerce Ninja Forms Product Add-ons Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5601 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 2bbb91735283 Credits Alexander Concha...

WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload

Description The plugin does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE. PoC Make sure to have both WooCommerce and NinjaForms 3.4.34.2 NF's latest version on the 3.4 branch installed, then follow those...

WordPress Royal Elementor 1.3.78 Shell Upload Vulnerability

Today, on October 16, 2023, the Wordfence Threat Intelligence Team became aware of a vulnerability that was recently patched in Royal Elementor Addons and Templates, a WordPress plugin installed on over 200,000 sites, that makes it possible for unauthenticated attackers to upload arbitrary files ...

CVE-2023-35018

IBM Security Verify Governance (Identity Manager virtual appliance) is affected by CVE-2023-35018, where a privileged user could upload arbitrary files due to improper file validation. The issue affects version pre-10.0.2 FP0 in the Identity Manager virtual appliance component. IBM’s bulletin als...

PT-2023-25097 · Ibm · Ibm Security Verify Governance Identity Manager +1

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0 IBM Security Verify Governance Identity Manager version 10.0 Description: The issue is related to improper file validation, allowing a privileged user to upload arbitrary files. Additionally, there ...

IBM Security Verify Governance Code Issue Vulnerability

IBM Security Verify Governance is an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define and control user access and access risk. A code issue vulnerability exists in IBM Security Verify Governance version...

WordPress Royal Elementor Addons Plugin <= 1.3.78 is vulnerable to Arbitrary File Upload

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.78 Fixed in 1.3.79 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5360 Patch priority High CVSS severity High 10 Developer WProyal PSID 367ca965d960 Credits Fioravante Souza Required privilege...

PortlandLabs Concrete CMS Arbitrary File Upload Vulnerability

PortlandLabs Concrete CMS is a team-oriented open source content management system of the United States PortlandLabs company . An arbitrary file upload vulnerability exists in PortlandLabs Concrete CMS version v9.2.1, which stems from the application's lack of effective validation of uploaded...

VulnCheck KEV: CVE-2023-5360

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE...

Arbitrary File Upload

concrete5/concrete5 is vulnerable to Arbitrary File Upload. The vulnerability exists due to the lack of sanitization in the Thumbnail file upload section, which allows an attacker to upload maliciously crafted PDF, SVG, or HTML files, potentially leading to Cross-Site Scripting XSS attacks...

Security Bulletin: IBM Security Verify Governance - Identity Manager (Virtual Appliance) is affected by multiple vulnerabilities (CVE-2023-35903, CVE-2023-35018, CVE-2023-35013, X-Force ID 220945)

Summary IBM Security Verify Governance - Identity Manager Virtual Appliance is vulnerable to arbitrary file upload, escalation of privileges, and sensitive information leak. These issues have been addressed in this update. Vulnerability Details CVEID:CVE-2023-35903 DESCRIPTION: IBM Security Verif...

GHSA-WRP2-6V6J-HFMG ConcreteCMS vulnerable to Stored Cross-site Scripting

Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail file upload, which allows Cross-Site Scripting XSS...

CVE-2023-44763

Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting XSS. NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the...

Cross site scripting

DISPUTED Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting XSS. NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is o...