14825 matches found
CVE-2023-27235
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file...
Privilege escalation
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file...
CVE-2023-27757
An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file...
Design/Logic Flaw
An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file...
CVE-2023-27235
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file...
PerfreeBlog 代码问题漏洞
PerfreeBlog is a java-based blog/CMS builder. A security vulnerability exists in PerfreeBlog v3.1.1, which originates from an arbitrary file upload vulnerability found in the /admin/user/uploadImg component. An attacker can exploit this vulnerability to execute arbitrary code via a specially...
CVE-2023-27757
CVE-2023-27757 concerns PerfreeBlog v3.1.1, where an arbitrary file upload flaw in the /admin/user/uploadImg component allows an attacker to execute arbitrary code via a crafted JPG file. The vulnerability is treated as critical (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with high impact on...
CVE-2023-27235
CVE-2023-27235 affects Jizhicms v2.4.5 in the admin/c/CommonController.php component. The vulnerability allows arbitrary code execution via uploading a crafted .phtml file, enabling an attacker to run code on the server. CVSS 3.1 base score 7.2 (HIGH); network attack vector, low access complexity...
CVE-2023-27235
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file...
CVE-2023-27757
An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file...
CVE-2023-27235
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file...
CVE-2023-0477
The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...
CVE-2023-0477 Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload
The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...
WordPress Plugin Auto Featured Image 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...
CVE-2023-27164
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file...
CVE-2023-27164
CVE-2023-27164 affects Halo up to v1.6.1 with an arbitrary file upload in .md files that can lead to arbitrary code execution. Documents confirm the vulnerability and affected versions; no exploitation details are provided. Remediation guidance appears in PT-2023-20983: upgrade to a version later...
CVE-2023-27164
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file...
CVE-2023-27164
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file...