Privilege escalation

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/usersadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41538

CVE-2022-41538 affects Wedding Planner v1.0. The issue is an arbitrary file upload vulnerability in the /Wedding-Management-PHP/admin/photos_add.php component that can allow an attacker to execute arbitrary PHP code via a crafted file. Reported base metrics indicate a high-severity impact (CVSS v...

CVE-2022-41539

CVE-2022-41539 affects Wedding Planner v1.0, with an arbitrary file upload vulnerability in the /admin/users_add.php component. The flaw enables an attacker to execute arbitrary code via a crafted PHP file. Impact is described as code execution, with high severity (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S...

CVE-2022-41539

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/usersadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-25924 · Unknown · Wedding Planner

Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the /Wedding-Management-PHP/admin/photos add.php component. This allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41538

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Management-PHP/admin/photosadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

The plugin is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files 1 Create 'poc.zip' with 2 files like below 1-1 'exploit.php.txt' is as follows...

CVE-2022-41538

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Management-PHP/admin/photosadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

The plugin is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files PoC 1 Create 'poc.zip' with 2 files like below 1-1 'exploit.php.txt' is as follows...

CVE-2022-41539

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/usersadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41534

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41534

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41533

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41533

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41534

CVE-2022-41534 affects Online Diagnostic Lab Management System v1.0. The connected documents confirm an arbitrary file upload vulnerability in the component /php_action/createOrder.php that enables an attacker to execute arbitrary PHP code via a crafted file. This is the core technical detail; no...

CVE-2022-41533

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41533

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41534

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41533

The CVE-2022-41533 entry concerns Online Diagnostic Lab Management System v1.0, with an arbitrary file upload vulnerability in the /php_action/editProductImage.php component that enables arbitrary PHP code execution. Affected software is explicitly stated as Online Diagnostic Lab Management Syste...

CVE-2022-41534

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...