PT-2024-26564 · Box-Im · Box-Im

Name of the Vulnerable Software and Affected Versions: Box-IM version 2.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PDF file, exploiting an arbitrary file upload vulnerability in the Upload function. Recommendations: For Box-IM version 2.0, consider...

PT-2024-24472 · Unknown · Phpgurukul Tourism Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Tourism Management System version 2.0 Description: The issue concerns an unrestricted upload of files with dangerous types via the tms/admin/create-package.php endpoint. When creating a new package, there are no checks for the type...

PT-2024-22879 · Gnu · Gnu Savane

Name of the Vulnerable Software and Affected Versions: GNU Savane versions 3.13 and earlier Description: An issue allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the "upload.php" component. Recommendations: For GNU Savane versions 3.13 and earlier,...

PT-2024-23581 · Unknown +1 · Ros Python Version +1

Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 versions 2 through 2, ROS PYTHON VERSION 3 Description: An arbitrary file upload issue has been discovered, allowing attackers to execute arbitrary code, cause a denial of service DoS, and obtain sensitive...

PT-2023-31918 · Unknown · Resumable.Php

Name of the Vulnerable Software and Affected Versions: resumable.php versions 0.1.4 through 3c6dbf5 Description: The issue allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. It is noted that file overwrite has not been possible with the...

PT-2023-28210 · Ca · Arcserve Udp

Name of the Vulnerable Software and Affected Versions: Arcserve UDP versions prior to 9.2 Description: The issue allows an unauthenticated remote attacker to exploit a path traversal vulnerability in the com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload function to upload arbitrary...

PT-2023-32328 · Sourcecodester · Sourcecodester File Manager App

Name of the Vulnerable Software and Affected Versions: SourceCodester File Manager App version 1.0 Description: A critical vulnerability was found in the SourceCodester File Manager App, affecting an unknown functionality of the file endpoint "add-file.php". The manipulation of the uploadedFileNa...

PT-2023-32127 · Byzoro · Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform versions up to 20230928 Description: A critical issue affects some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the file upload...

PT-2023-26271 · Sourcecodester · Sourcecodester House Rental/Property Listing

Name of the Vulnerable Software and Affected Versions: SourceCodester House Rental and Property Listing System version 1.0 Description: A critical vulnerability was found in the system, affecting an unknown function of the file btn functions.php. This issue leads to unrestricted upload and can be...

PT-2023-24339 · WordPress · User Registration

Name of the Vulnerable Software and Affected Versions: User Registration plugin for WordPress versions up to, and including, 3.0.2 Description: The issue arises from a hardcoded encryption key and missing file type validation on the ur upload profile pic function. This allows authenticated...

PT-2023-25036 · Youxun Electronic Equipment (Shanghai) Co. · Ac Centralized Management Platform

Name of the Vulnerable Software and Affected Versions: Youxun Electronic Equipment Shanghai Co., Ltd AC Centralized Management Platform version 1.02.040 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code via uploading a crafted HTML file to the "upfile.cgi" A...

PT-2023-2229 · Sjqzhang · Go-Fastdfs

Name of the Vulnerable Software and Affected Versions: sjqzhang go-fastdfs versions up to 1.4.3 Description: The issue is related to a path traversal vulnerability in the file upload function of the sjqzhang go-fastdfs distributed file system. This vulnerability can be exploited by a remote...

PT-2023-19252 · Sap · Sap Business Planning/Consolidation

Name of the Vulnerable Software and Affected Versions: SAP Business Planning and Consolidation versions 200, 300 Description: The issue allows an attacker with business authorization to upload any files, including web pages, without proper file format validation. If other users visit the uploaded...

PT-2022-8621 · Unknown · Zhimengzhe Ibarn

Name of the Vulnerable Software and Affected Versions: zhimengzhe iBarn version 1.5 Description: The issue allows remote attackers to run arbitrary code via avatar upload to "index.php". This is due to a file upload vulnerability in the upload function in action/Core.class.php. Recommendations: F...

PT-2022-27168 · Thinkphp · Thinkphp

Name of the Vulnerable Software and Affected Versions: Thinkphp versions 5.0.24 through 5.1.41 Description: The issue is caused by a code logic error that leads to a file upload getting shell access. This allows an attacker to potentially execute arbitrary code on the server. Recommendations: For...

PT-2022-24793 · Unknown · College Management System

Name of the Vulnerable Software and Affected Versions: College Management System version 1.0 Description: The issue allows an admin user to upload a .php file containing malicious code via the student.php file, potentially leading to remote code execution. The authentication required for this...

PT-2022-16556

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description The ACEweb Online Portal contains an issue that allows for unrestricted file upload via the attachments.awp endpoint. Recommendations For ACEweb Online Portal version 3.5.065, consider restricti...

PT-2022-16740 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: Flatpress version 1.2.1 Description: A cross-site scripting XSS issue was found in the Upload SVG File function. This could potentially allow attackers to inject malicious scripts into websites. Recommendations: For Flatpress version 1.2.1,...

[SA16357] e107 HTML / TXT Attachment Script Insertion Vulnerability

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

[SA16348] Invision Power Board HTML / TXT Attachment Script Insertion

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...