20 matches found
CVE-2024-42640
CVE-2024-42640 Unauthenticated Remote Code Execution via Angular-Base64-Upload Library CVE-2024-42640 Angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploiting this vulnerability allow...
CVE-2024-42640
CVE-2024-42640 angular-bug CVE-2024-42640 通过 Angular-Base64-Upload 库实现的未认证远程代码执行 更多详情：博客 简介 angular-base64-upload v0.1.21 之前的版本容易受到通过 angular-base64-upload/demo/server.php 端点进行的未认证远程代码执行攻击。利用此漏洞，攻击者可以向服务器上传任意文件内容，随后可通过 angular-base64-upload/demo/uploads 端点访问这些文件。这会导致先前上传的内容被执行，并最终使攻击者能够在服务器上实现代码执...
CVE-2026-54179 backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and...
GHSA-8HW4-7QJR-3WXG Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...
OPENSUSE-SU-2026:20578-1 Security update for python-Django
This update for python-Django fixes the following issues: Changes in python-Django: - CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation bsc1261729 - CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin bsc1261731 - CVE-2026-4292: Privilege abuse in ModelAdmin.listeditable...
CVE-2026-35180 WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customizesettingsnativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with...
CVE-2026-35180 WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customizesettingsnativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with...
CVE-2024-42640
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of...
Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
Exploit Title: Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution RCE Date: 10 October 2024 Discovered by : Ravindu Wickramasinghe | rvz @rvizx9 Exploit Author: Ravindu Wickramasinghe | rvz @rvizx9 Vendor Homepage: https://www.npmjs.com/package/angular-base64-upload...
📄 Angular-Base64-Upload Library Remote Code Execution
Angular-Base64-Upload library unauthenticated remote code execution proof of concept exploit that affects versions prior to 0.1.21. !/bin/python3 Exploit Title: Unauthenticated RCE via Angular-Base64-Upload Library Date: 10 October 2024 Discovered by : Ravindu Wickramasinghe | rvz @rvizx9 Exploit...
Exploit for CVE-2024-42640
CVE-2024-42640 Unauthenticated Remote Code Execution via Angul...
Remote Code Execution (RCE)
angular-base64-upload is vulnerable to Remote Code Execution RCE. The vulnerability is due to a lack of proper access controls in demo/server.php, allowing attackers to upload arbitrary content, which can then be executed from demo/uploads...
VulnCheck KEV: CVE-2024-42640
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of...
angular-base64-upload vulnerable to unauthenticated remote code execution
angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the...
GHSA-VGXQ-6RCF-QWRW angular-base64-upload vulnerable to unauthenticated remote code execution
angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the...
CVE-2024-42640
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of...
angular-base64-upload 安全漏洞
angular-base64-upload is a library by the individual developers of Adones Pitogo. A security vulnerability exists in angular-base64-upload prior to version 0.1.21, which stems from vulnerability to an unauthenticated remote code execution attack via demo/server.php...
CVE-2024-42640
CVE-2024-42640 affects the Angular-base64-upload library prior to v0.1.21. The root cause is unauthenticated remote code execution via the demo/server.php endpoint, allowing an attacker to upload arbitrary content that can be accessed at demo/uploads and executed on the server. Affected packages ...
PT-2024-6803 · Unknown · Angular-Base64-Upload
Name of the Vulnerable Software and Affected Versions: angular-base64-upload versions prior to v0.1.21 Description: The issue is related to the angular-base64-upload library, which has a vulnerability that allows an attacker to execute arbitrary code on the server by uploading a specially crafted...