WordPress CM Download Manager Arbitrary File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Arbitrary file upload...

Zoo Management System save_event Arbitrary File Upload Vulnerability

Zoo Management System is a zoo management system. It provides an online and automated platform for zoo organizations to manage their daily records. An arbitrary file upload vulnerability exists in Zoo Management System v1.0, which arises from a lack of validation of uploaded files at the image...

Rocket.Chat getS3FileUrl Meteor Information Disclosure Vulnerability

Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in Rocket.Chat versions prior to 4.7.5, 4.8.0 and later, and prior to 4.8.2. The vulnerability exists in the getS3FileUrl Meteor server method, which can be exploited by an authenticated attacker to...

CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

Design/Logic Flaw

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

Privilege escalation

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

CVE-2022-40050: ZFile v4.1.1 contains an arbitrary file upload vulnerability in the /file/upload/1 endpoint due to lack of validation. Documented impact includes potential remote code execution by uploading malicious files; explicit exploit details are not provided in all sources, but CNVD/CNNVD ...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40925

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveevent" file of the "Events" module in the background management system...

CVE-2022-40924

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

CVE-2022-40924

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

CVE-2022-40924

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

Privilege escalation

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

Privilege escalation

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveevent" file of the "Events" module in the background management system...

CVE-2022-3076

CM Download Manager for WordPress (plugin before 2.8.6) allows high-privilege users (admin) to upload arbitrary files by adding extensions (e.g., PHP) in Settings, without proper validation. This can enable an authenticated admin to place malicious PHP files in the site uploads path, with PoC evi...

CVE-2022-3076 CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example...