CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

Design/Logic Flaw

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

Privilege escalation

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

CVE-2022-40050: ZFile v4.1.1 contains an arbitrary file upload vulnerability in the /file/upload/1 endpoint due to lack of validation. Documented impact includes potential remote code execution by uploading malicious files; explicit exploit details are not provided in all sources, but CNVD/CNNVD ...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40050

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...

CVE-2022-40925

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveevent" file of the "Events" module in the background management system...

CVE-2022-40924

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

CVE-2022-40924

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

CVE-2022-40924

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

Privilege escalation

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveevent" file of the "Events" module in the background management system...

Privilege escalation

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

CVE-2022-3076 CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example...

CVE-2022-3076

CM Download Manager for WordPress (plugin before 2.8.6) allows high-privilege users (admin) to upload arbitrary files by adding extensions (e.g., PHP) in Settings, without proper validation. This can enable an authenticated admin to place malicious PHP files in the site uploads path, with PoC evi...

CVE-2021-24890 Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload

The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a...

CVE-2021-24890 Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload

The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a...

CVE-2022-40925

CVE-2022-40925 affects Zoo Management System v1.0. The vulnerability is an arbitrary file upload in the picture upload point of the save_event file within the Events module of the backend management system, caused by a lack of validation for uploaded files. This can enable remote code execution a...

CVE-2022-40925

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveevent" file of the "Events" module in the background management system...