CVE-2021-40954

Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary code...

CVE-2021-40954

CVE-2021-40954 affects Laiketui 3.5.0. The connected documents confirm an arbitrary file upload vulnerability in Laiketui that can allow an attacker to execute arbitrary code. Affected component is the file upload mechanism within Laiketui 3.5.0; root cause specifics are not provided in the docum...

Docebo Community Edition 代码问题漏洞

Docebo Community Edition is a learning suite from Docebo Canada. A code issue vulnerability exists in Docebo Community Edition version v4.0.5 and prior versions, which stems from a contained arbitrary file upload vulnerability...

CVE-2022-31362

CVE-2022-31362 affects Docebo Community Edition v4.0.5 and earlier. Multiple sources document an arbitrary file upload vulnerability in these unsupported versions; the exact root cause is not detailed in the provided materials. Some advisories (e.g., PT-2022-20717) suggest temporarily restricting...

CVE-2022-31362

Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

PT-2022-20717 · Docebo · Docebo Community Edition

Name of the Vulnerable Software and Affected Versions: Docebo Community Edition versions 4.0.5 and below Description: The issue is related to an arbitrary file upload vulnerability. It is noted that this vulnerability only affects products that are no longer supported by the maintainer...

CVE-2021-38945

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238...

CVE-2022-31374

An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file...

Privilege escalation

An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file...

CVE-2022-31374

The Contec SolarView Compact v6.0 application is susceptible to a Remote Code Execution (RCE) vulnerability. The root cause is a failure in Solar_Image.php to properly filter special elements within the construction snippet, which allows an attacker to perform an arbitrary file upload at the /ima...

CVE-2022-1939 Allow SVG Files < 1.1 - Admin+ Arbitrary File Upload

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to...

WordPress eaSYNC plugin <= 1.1.15 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by cydave in WordPress eaSYNC plugin versions = 1.1.15. Solution Update the WordPress eaSYNC plugin to the latest available version at least 1.1.16...

eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload

The plugin suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validatio...

TPCMS arbitrary file upload vulnerability

TPCMS, an open source content management system from the individual developers of Source of Happiness, is vulnerable to an arbitrary file upload vulnerability in version v3.2, which stems from a lack of validation of uploaded files by the application. An attacker could exploit this vulnerability ...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54294)

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to arbitrary file uploads, which can be exploited by attackers to upload malicious files and remotely execute arbitrary code...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54289)

Wedding Management System v1.0 is an arbitrary file upload vulnerability in the packageedit.php page, which is caused by a lack of validation of the image upload port on the packageedit.php page. The vulnerability is caused by the lack of validation of uploaded files on the packageedit.php page,...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54291)

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. The vulnerability is caused by a lack of validation of the uploaded files in the photosedit.php page, which could be exploited to upload malicious files and remotely execute...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54295)

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. An attacker can exploit this vulnerability to upload malicious files and remotely execute arbitrary code...

Path Traversal in file editor on Windows in Gogs

Impact The malicious user is able to delete and upload arbitrary files. All installations on Windows with repository upload enabled default are affected. Patches Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...

Arbitrary File Upload

github.com/mindoc-org/mindoc is vulnerable to arbitrary file upload. The vulnerability exists in Unzip function in ziptil.go due to file upload permissions and validations are not properly handled which allows an attacker to upload malicious files...