GHSA-86P5-97JR-R598 Arbitrary file upload in ShopXO

An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations...

Arbitrary file upload in ShopXO

An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations...

Foxit PDF Editor 代码问题漏洞

Foxit PDF Editor is a PDF editor from Foxit, a Chinese company. Foxit PDF Editor version 11.3.1 has an arbitrary file upload vulnerability, no detailed vulnerability details are provided...

CVE-2021-41938

An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations...

Privilege escalation

An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations...

CVE-2021-41938

An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations...

CVE-2021-41938

CVE-2021-41938 affects ShopXO CMS 2.2.0. The issue is an arbitrary file upload vulnerability in three locations on the management page, caused by upload functions not properly restricting file types/paths. The CVSS-based assessment indicates a high-severity impact (3.1: HIGH, network access, unli...

ShopXO 代码问题漏洞

ShopXO is an open source enterprise-level open source e-commerce system. A security vulnerability exists in ShopXO version 2.2.0, which originates from an arbitrary file upload issue in three locations...

Arbitrary File Upload

Overview typo3/cms is a free open source Content Management Framework. Affected versions of this package are vulnerable to Arbitrary File Upload due to improper checks on file extensions in the file upload component and File Abstraction Layer. Remediation Upgrade typo3/cms to version 6.0.8, 6.1.3...

TeamPass arbitrary file upload vulnerability

An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in...

GHSA-RM3Q-QFRM-FRRV TeamPass arbitrary file upload vulnerability

An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in...

Formidable arbitrary file upload

Withdrawn: This advisory was improperly assigned. An arbitrary file upload vulnerability in formidable v3.2.4 allows attackers to execute arbitrary code via a crafted filename...

Connect-Multiparty allows arbitrary file upload

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

GHSA-W2XW-44R3-4V9G Connect-Multiparty allows arbitrary file upload

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

Withdrawn: Code execution via SVG file upload in tiddlywiki

Withdrawn Advisory This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information. Original Description An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via...

GHSA-CR9C-RHQ6-VH53 Withdrawn: Code execution via SVG file upload in tiddlywiki

Withdrawn Advisory This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information. Original Description An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via...

CVE-2022-1103

The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE...

Design/Logic Flaw

The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE...

Code injection

The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE...

CVE-2022-29623

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...