Remote Code Execution (RCE)

cockpit-hq/cockpit is vulnerable to Remote Code Execution RCE. The vulnerability is due to a lack of file extension validation for user supplied files which allows an attacker to upload and execute malicious PHP code...

CVE-2023-0477

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

CVE-2023-0477 Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

CVE-2023-0477 Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation...

PT-2023-16292 · WordPress · Auto Featured Image

Name of the Vulnerable Software and Affected Versions: Auto Featured Image Auto Post Thumbnail WordPress plugin versions prior to 3.9.16 Description: The issue is caused by incorrect file extension validation, allowing any user with at least Author privileges to upload arbitrary files, such as PH...

CVE-2022-31041: Improper Input Validation

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users e.g. only PDF / Excel / .... The input validation of uploaded fil...

GHSA-89FP-J8V7-P82H Microweber allows Unrestricted File Upload

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...

CVE-2021-43484

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

CVE-2021-43484

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

CVE-2021-43484: Improper Neutralization of Special Elements used in an SQL Command

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

CVE-2021-24216 All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE

The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations...

CVE-2021-24216

CVE-2021-24216 — All-in-One WP Migration (WordPress) Affected software: WordPress All-in-One WP Migration plugin prior to version 7.41. Vulnerability: The plugin does not validate uploaded files’ extensions, enabling administrators to upload PHP files on their site, including multisite installati...

CVE-2021-43620

An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::fromptr on a pointer to the string buffer, the string ...

CVE-2021-43620: Undefined Security Weakness

An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::fromptr on a pointer to the string buffer, the string ...

Rust 安全漏洞

A security vulnerability exists in Mozilla Rust, a general-purpose, compiled programming language from the Mozilla Foundation. The vulnerability stems from the fact that security-related validation of file extensions may be compromised. The NSString method used to convert to a string may return...

Tobesoft NEXACRO14 安全漏洞

Tobesoft NEXACRO14 is a BUX platform from Tobesoft Korea, developed as a JavaScript-based stand-alone framework to accommodate the company's various development needs. Applications developed using the Nexacro platform require no additional development to achieve the same functionality across a wi...

CVE-2021-37334

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a...

CVE-2021-24347 SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be...

CVE-2020-13774

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations ...

Unrestricted file upload

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations ...