CVE-2024-37631

TOTOLINK A3700R V9.1.2u.616520211012 was discovered to contain a stack overflow via the File parameter in function UploadCustomModule...

CVE-2024-10100

A path traversal vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as...

CVE-2024-57549

CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request...

CVE-2023-32986

Jenkins File Parameter Plugin 285.v757c5b67ac25 and earlier does not restrict the name and resulting uploaded file name of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified...

CVE-2023-22586

The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter...

Kelixun Communication Command and Dispatch Management Platform 命令注入漏洞

Kelixun Communication Command and Dispatch Management Platform Kelixun is a communication command and dispatch management platform from Kelixun, China. A command injection vulnerability exists in Kelixun Communication Command and Dispatch Management Platform version 1.0, which originates from os...

CVE-2022-41520

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function...

CVE-2022-34125

front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a log/ pathname in the file parameter...

CVE-2022-29398

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN0041309c...

CVE-2021-39433

A local file inclusion LFI vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user...

CVE-2021-24154

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the downloadfile function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd...

CVE-2020-8429

The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs...

CVE-2020-9467

Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function...

CVE-2018-1000218

OpenEMR version v5014 contains a Cross Site Scripting XSS vulnerability in The 'file' parameter in line 43 of interface/fax/faxview.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via...

Seaglider Basestation Software 安全漏洞

Seaglider Basestation Software is a Seaglider basestation from iop-apl-uw open source. A security vulnerability exists in Seaglider Basestation Software 3 3.0.4 and earlier versions, which stems from improper handling of the qcfile parameter in the file basestation3/qc.py, which could lead to a...

ssm-erp 代码问题漏洞

ssm-erp is a production management ERP system by fenghaha individual developer. A code issue vulnerability exists in ssm-erp version 1.0, which stems from the incorrect operation of the parameter File in the file PictureServiceImpl.java resulting in unlimited uploads...

JeecgBoot 安全漏洞

JeecgBoot is a Java low-code platform for enterprise web applications from China National Torch Jeecg. A security vulnerability exists in JeecgBoot 3.8.0 and earlier versions that originates from resource consumption due to incorrect manipulation of the parameter File in the file...

ContiNew Admin 代码注入漏洞

ContiNew Admin is ContiNew open source a continuous iterative optimization of front-end and back-end separation of middle and back-end management system framework. A code injection vulnerability exists in ContiNew Admin 3.6.0 and earlier versions, which stems from cross-site scripting due to...

CTCMS 路径遍历漏洞

CTCMS Chibi CMS is a video content management system from China Chibi CMS CTCMS company. A path traversal vulnerability exists in CTCMS version 2.1.2, which stems from path traversal due to incorrect operation of the parameter File in the file ctcmsappscontrollersadminTpl.php...

Projectworlds Car Rental Project 注入漏洞

Projectworlds Car Rental Project is a car rental project by Projectworlds India. An injection vulnerability exists in Projectworlds Car Rental Project version 1.0, which stems from the mishandling of the fname parameter in the /signup.php file, which could lead to an SQL injection attack...