CVE-2020-21516

There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code...

CVE-2020-21516

FeehiCMS 2.0.8 contains an arbitrary file upload vulnerability in the head image/avatar upload pathway, enabling attackers to execute PHP code on the server. The issue is documented across multiple sources (including Red Hat, Veracode, GHSA, OSV, and NVD) with CVSS v3.1 base score 9.8 (CRITICAL, ...

FeehiCMS 代码问题漏洞

FeehiCMS is a Php-based CMS builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.0.8, which originates from an arbitrary file upload vulnerability during avatar upload. An attacker can exploit this vulnerability to execute related PHP code...

PT-2022-8641 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: FeehiCMS versions 2.0.8 through 2.0.8.1 Description: The issue is related to an arbitrary file upload vulnerability at the head image upload, allowing attackers to execute relevant PHP code. Recommendations: For FeehiCMS version 2.0.8, update...

Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload

The plugin does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file PoC POST /wp-admin/admin-ajax.php...

CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

The plugin allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example. Activate PHP extension: - Log in and go to "CM Downloads" "Settings" "General". -...

CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

The plugin allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example. PoC Activate PHP extension: - Log in and go to "CM Downloads" "Settings" "General"...

Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload

The plugin does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file POST /wp-admin/admin-ajax.php...

WordPress Scripts Organizer premium plugin < 3.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Ovidiu Maghetiu in WordPress Scripts Organizer premium plugin versions 3.0 Solution Update the WordPress Scripts Organizer plugin to the latest available version at least 3.0...

CVE-2022-36582

An arbitrary file upload vulnerability in the component /phpaction/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-36580

An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-36582

An arbitrary file upload vulnerability in the component /phpaction/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-36580

An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file...

Privilege escalation

An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file...

Privilege escalation

An arbitrary file upload vulnerability in the component /phpaction/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-36582

An arbitrary file upload vulnerability in the component /phpaction/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-36582

CVE-2022-36582 affects Garage Management System v1.0; the vulnerability is an arbitrary file upload in /php_action/createProduct.php that can lead to arbitrary code execution via a crafted PHP file. The CVE details are consistently described across sources (product, component, access path, and im...

CVE-2022-36580

An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-36580

CVE-2022-36580 affects Online Ordering System v2.3.2 via the /admin/products/controller.php?action=add component, enabling arbitrary code execution through an crafted PHP file due to an arbitrary file upload vulnerability. Public sources in the connected documents reiterate the exact vulnerable c...

PT-2022-23486 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the /php action/createProduct.php component. Recommendations:...