CVE-2022-29451: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin = 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory...

Trend Micro Apex Central RCE (000290678)

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex Central prior to patch 3 build 6016. It is, therefore, affected by an arbitrary file upload vulnerability. An unauthenticated, remote attacker could exploit this to upload arbitrary file...

CVE-2021-43934

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files...

Monstaftp arbitrary file upload vulnerability

Monstaftp is a modern Web interface for FTP. version v2.10.3 of Monstaftp is vulnerable to an arbitrary file upload vulnerability, which stems from the application's lack of valid validation of uploaded files. An attacker could exploit this vulnerability to execute arbitrary code via a crafted fi...

CVE-2021-43934: Unrestricted Upload of File with Dangerous Type

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files...

CVE-2022-28525

ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edituser&id=1...

CVE-2022-28449

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting XSS. At Apply for vendor account feature, an attacker can upload an arbitrary file to the system...

CVE-2022-28449

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting XSS. At Apply for vendor account feature, an attacker can upload an arbitrary file to the system...

CVE-2022-28525

ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edituser&id=1...

CVE-2022-28525

ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edituser&id=1...

CVE-2022-28528

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

Cross site scripting

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting XSS. At Apply for vendor account feature, an attacker can upload an arbitrary file to the system...

Design/Logic Flaw

ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edituser&id=1...

CVE-2022-28528

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

CVE-2022-28528

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

CVE-2022-28525

ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edituser&id=1...

CVE-2022-28525

CVE-2022-28525 affects ED01-CMS v20180505. The vulnerability is an arbitrary file upload via /admin/users.php?source=edit_user&id=1, indicating insecure handling of file uploads in the user edit functionality. According to the records, the CVSS metrics (2.0/3.1) show a network-based, low-effort p...

CVE-2022-28449

CVE-2022-28449 concerns nopCommerce 4.50.1, where the vendor-account application flow allows uploading an arbitrary file. Multiple sources describe an unrestricted file-upload issue in this product version (notably via the user-facing Apply for Vendor Account path and related UploadAvatar logic i...

CVE-2022-28449

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting XSS. At Apply for vendor account feature, an attacker can upload an arbitrary file to the system...

CVE-2022-28449

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting XSS. At Apply for vendor account feature, an attacker can upload an arbitrary file to the system...