CVE-2022-40777

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

Design/Logic Flaw

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

PT-2022-25846 · Unknown · Church Management System

Name of the Vulnerable Software and Affected Versions: Church Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability in the /admin/admin pic.php component. This allows attackers to execute arbitrary code via a crafted PHP file. The "arbitrary file...

BigCommerec Interspire Email Marketer 代码问题漏洞

Bigcommerec BigCommerec Interspire Email Marketer IEM is a suite of email marketing software from the US-based company Bigcommerec. A security vulnerability exists in Interspire Email Marketer version 6.5.0 that originates from allowing arbitrary files to be uploaded via the surveyssubmit.php...

CVE-2022-40777

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

CVE-2022-40921

CVE-2022-40921 refers to a vulnerability in DedeCMS v5.7.99 where an arbitrary file upload is possible through the component /dede/file_manage_control.php. The available documents consistently identify the affected product and the vulnerable function but do not detail the exact root cause beyond ...

WordPress Frontend File Manager Arbitrary File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. WordPress Frontend File Manager versions prior to 21.3 are vulnerable to arbitrary file uploads, whi...

CreativeDream php uploader arbitrary file upload vulnerability

CreativeDream php uploader is an easy-to-use, high-performance file upload script for CreativeDream personal developers. CreativeDream php uploader version 0.3 is vulnerable to arbitrary file uploads, which stem from a lack of valid validation of uploaded files by the application. An attacker cou...

CVE-2022-40777

Interspire Email Marketer 6.5.0 and earlier allow arbitrary file uploads via surveys_submit.php (create survey and submit survey), enabling PHP files to be placed under admin/temp/surveys/. This CVE (CVE-2022-40777) links to an incomplete fix of CVE-2018-19550 and is supported by older advisories...

PT-2022-25535 · Interspire · Interspire Email Marketer

Name of the Vulnerable Software and Affected Versions: Interspire Email Marketer versions prior to 6.5.1 Description: The issue allows for arbitrary file upload through a "create survey and submit survey" operation in surveys submit.php. This can lead to a .php file being accessible under the...

PT-2022-25619 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.99 Description: The issue allows for an arbitrary file upload via the component /dede/file manage control.php. Recommendations: For DedeCMS version 5.7.99, at the moment, there is no information about a newer version that...

JVN#74592196: bingo!CMS vulnerable to authentication bypass

bingo!CMS provided by Shift Tech Inc. contains an authentication bypass vulnerability CWE-288 in some of the management functions. Shift Tech Inc. states that attacks exploiting this vulnerability have been observed. Impact Accessing a specific URL directly may allow a remote unauthenticated...

CVE-2022-41406

An arbitrary file upload vulnerability in the /admin/adminpic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

Church Management System 代码问题漏洞

Church Management System is a church management system. A security vulnerability exists in Church Management System v1.0, which stems from an arbitrary file upload vulnerability in the /admin/adminpic.php component that allows an attacker to execute arbitrary code via a crafted PHP file...

CVE-2022-41406

An arbitrary file upload vulnerability in the /admin/adminpic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-40921

DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/filemanagecontrol.php...

Desdev DedeCMS 代码问题漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS V5.7.99 version of a security...

CVE-2022-41406

CVE-2022-41406 concerns an arbitrary file upload vulnerability in Church Management System v1.0, specifically the /admin/admin_pic.php component, allowing an attacker to execute arbitrary code via a crafted PHP file. The CVSS data in the entry indicates high impact (Confidentiality, Integrity, Av...

Unspecified vulnerability in Online Leave Management System (CNVD-2022-68288)

Online Leave Management System is an online leave management system. version v1.0 of Online Leave Management System contains a security vulnerability that stems from the existence of an arbitrary file upload vulnerability allowing an attacker to execute arbitrary code via a crafted PHP file. No...

Metersphere arbitrary file upload vulnerability

MeterSphere is MeterSphere's open source one-stop open source continuous testing platform. metersphere has an arbitrary file upload vulnerability, which can be exploited by remote attackers to submit special requests that can upload malicious files and write cron jobs to execute commands...