14826 matches found
CVE-2022-1540 PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP leading to RCE...
VulnCheck KEV: CVE-2021-24311
The wpajaxupload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users...
PT-2022-13941 · WordPress · Postmagthemes Demo Import
Name of the Vulnerable Software and Affected Versions: PostmagThemes Demo Import WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue allows high-privilege users, such as admins, to upload arbitrary files, including PHP files, due to a lack of validation of the imported file. This...
WordPress plugin PostmagThemes Demo Import 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...
CVE-2022-36431
An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1...
CVE-2022-36431
An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1...
Lansweeper 路径遍历漏洞
Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A path traversal vulnerability exists in Lansweeper version 10.1.1.0, which stems from the presence of a path than there, a specially crafted...
PT-2022-23365 · Rocket · Rocket Trufusion Enterprise
Name of the Vulnerable Software and Affected Versions: Rocket TRUfusion Enterprise versions prior to 7.9.6.1 Description: The issue allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. This is due to an arbitrary file upload vulnerability. Recommendations: For versio...
DedeCMS V5.7 SP2 <= 5.7.107 RCE Vulnerability
DedeCMS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dedecms:dedecms"; ...
CVE-2022-36431
An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1...
Lansweeper lansweeper AssetActions.aspx directory traversal vulnerability
Talos Vulnerability Report TALOS-2022-1528 Lansweeper lansweeper AssetActions.aspx directory traversal vulnerability December 1, 2022 CVE Number CVE-2022-32573 SUMMARY A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A...
CVE-2022-38140
Auth. contributor+ Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin = 12.1.10 on WordPress...
CVE-2022-38140
Auth. contributor+ Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin = 12.1.10 on WordPress...
Design/Logic Flaw
Auth. contributor+ Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin = 12.1.10 on WordPress...
CVE-2022-38140 WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload
Auth. contributor+ Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin = 12.1.10 on WordPress...
CVE-2022-44401
Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php...
CVE-2022-44401
Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php...
Design/Logic Flaw
Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php...