CVE-2022-40777

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

CVE-2022-40777

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

Design/Logic Flaw

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

PT-2022-25846 · Unknown · Church Management System

Name of the Vulnerable Software and Affected Versions: Church Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability in the /admin/admin pic.php component. This allows attackers to execute arbitrary code via a crafted PHP file. The "arbitrary file...

CVE-2022-40777

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

BigCommerec Interspire Email Marketer 代码问题漏洞

Bigcommerec BigCommerec Interspire Email Marketer IEM is a suite of email marketing software from the US-based company Bigcommerec. A security vulnerability exists in Interspire Email Marketer version 6.5.0 that originates from allowing arbitrary files to be uploaded via the surveyssubmit.php...

CVE-2022-40921

CVE-2022-40921 refers to a vulnerability in DedeCMS v5.7.99 where an arbitrary file upload is possible through the component /dede/file_manage_control.php. The available documents consistently identify the affected product and the vulnerable function but do not detail the exact root cause beyond ...

JVN#74592196: bingo!CMS vulnerable to authentication bypass

bingo!CMS provided by Shift Tech Inc. contains an authentication bypass vulnerability CWE-288 in some of the management functions. Shift Tech Inc. states that attacks exploiting this vulnerability have been observed. Impact Accessing a specific URL directly may allow a remote unauthenticated...

CVE-2022-41406

An arbitrary file upload vulnerability in the /admin/adminpic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

Church Management System 代码问题漏洞

Church Management System is a church management system. A security vulnerability exists in Church Management System v1.0, which stems from an arbitrary file upload vulnerability in the /admin/adminpic.php component that allows an attacker to execute arbitrary code via a crafted PHP file...

PT-2022-25619 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.99 Description: The issue allows for an arbitrary file upload via the component /dede/file manage control.php. Recommendations: For DedeCMS version 5.7.99, at the moment, there is no information about a newer version that...

WordPress Frontend File Manager Arbitrary File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. WordPress Frontend File Manager versions prior to 21.3 are vulnerable to arbitrary file uploads, whi...

CreativeDream php uploader arbitrary file upload vulnerability

CreativeDream php uploader is an easy-to-use, high-performance file upload script for CreativeDream personal developers. CreativeDream php uploader version 0.3 is vulnerable to arbitrary file uploads, which stem from a lack of valid validation of uploaded files by the application. An attacker cou...

CVE-2022-40777

Interspire Email Marketer 6.5.0 and earlier allow arbitrary file uploads via surveys_submit.php (create survey and submit survey), enabling PHP files to be placed under admin/temp/surveys/. This CVE (CVE-2022-40777) links to an incomplete fix of CVE-2018-19550 and is supported by older advisories...

PT-2022-25535 · Interspire · Interspire Email Marketer

Name of the Vulnerable Software and Affected Versions: Interspire Email Marketer versions prior to 6.5.1 Description: The issue allows for arbitrary file upload through a "create survey and submit survey" operation in surveys submit.php. This can lead to a .php file being accessible under the...

CVE-2022-41406

CVE-2022-41406 concerns an arbitrary file upload vulnerability in Church Management System v1.0, specifically the /admin/admin_pic.php component, allowing an attacker to execute arbitrary code via a crafted PHP file. The CVSS data in the entry indicates high impact (Confidentiality, Integrity, Av...

CVE-2022-41406

An arbitrary file upload vulnerability in the /admin/adminpic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-40921

DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/filemanagecontrol.php...

Desdev DedeCMS 代码问题漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS V5.7.99 version of a security...

Unspecified vulnerability in Online Leave Management System (CNVD-2022-68288)

Online Leave Management System is an online leave management system. version v1.0 of Online Leave Management System contains a security vulnerability that stems from the existence of an arbitrary file upload vulnerability allowing an attacker to execute arbitrary code via a crafted PHP file. No...