15091 matches found
WordPress Hotels/Restaurant/Car Rental Free Booking plugin Arbitrary File Upload Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file upload...
RuoYi 跨站脚本漏洞
RuoYi is a backend management system for individual developers of China RuoYi RuoYi. A security vulnerability exists in RuoYi v4.7.3 and below, which stems from an arbitrary file upload vulnerability in the backend management module that allows an attacker to execute arbitrary code via a speciall...
User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload
The plugin does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded. 1 Create a file named exploit.php, which contains: ?php phpinfo; 2 Find the upfajaxnonce on the site's front page. 2 Run the following cURL request, curl --ur...
WordPress User Private Files plugin <= 1.1.2 - Authenticated Arbitrary File Upload vulnerability
Authenticated Arbitrary File Upload vulnerability discovered by Raad Haddad in WordPress User Private Files plugin versions = 1.1.2. Solution Update the WordPress User Private Files plugin to the latest available version at least 1.1.3...
CVE-2022-1952
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An...
Input validation
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An...
CVE-2022-1952 eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An...
Arbitrary File Upload
snipe/snipe-it is vulnerable to arbitrary file upload. The vulnerability exists in the store function in AcceptanceController.php due to improper validation of the update branding settings component, allowing an attacker to inject and execute arbitrary code through a maliciously crafted file...
WordPress plugin Free Booking Plugin for Hotels, Restaurant and Car Rental 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file upload...
Docebo Community Edition Arbitrary File Upload (CVE-2022-31362)
An arbitrary file upload vulnerability exists in Docebo Community Edition. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
GHSA-W82X-XJJR-CJR5 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
CVE-2022-32060
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
CVE-2022-32061
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
CVE-2022-32061
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Design/Logic Flaw
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Design/Logic Flaw
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...