CVE-2024-56156 Halo Vulnerable to Stored XSS and RCE via File Upload Bypass

Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks a...

CVE-2024-56156

CVE-2024-56156 affects Halo prior to 2.20.13. The vulnerability arises from a file type validation bypass in the upload mechanism, allowing malicious files (including executables and HTML) which can lead to stored XSS and, under certain circumstances, remote code execution. A fixed version, 2.20....

CVE-2024-56156 Halo Vulnerable to Stored XSS and RCE via File Upload Bypass

Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks a...

PT-2025-11625

Name of the Vulnerable Software and Affected Versions SOPlanning version 1.53.00 Description A file upload bypass issue exists, specifically in the "/process/upload.php" API endpoint, allowing remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploadin...

CVE-2024-57169

A file upload bypass vulnerability exists in SOPlanning version 1.53.00 , specifically within the /process/upload.php API endpoint. This flaw allows remote attackers to circumvent existing upload restrictions to upload malicious files, potentially leading to remote code execution (RCE) . While no...

CVE-2024-57169

A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploading malicious files...

CVE-2024-57169

A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploading malicious files...

CVE-2025-0526

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows...

CVE-2024-50660

File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality...

CVE-2024-50660

File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality...

PT-2025-2880

Name of the Vulnerable Software and Affected Versions AdPortal version 3.0.39 Description A remote attacker can execute arbitrary code via the file upload functionality due to a File Upload Bypass issue. This allows attackers to bypass file upload checks and run arbitrary code. Recommendations Fo...

CVE-2024-50660

File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality...

CVE-2024-11404 File Upload Bypass in django Filer

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS. This issue affects django Filer: from 3 before 3.3...

CVE-2024-8463

File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via webshell...

PT-2024-39030 · Unknown · Phpgurukul Job Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Job Portal version 1.0 Description: The issue is a file upload restriction bypass vulnerability, which could allow an authenticated user to execute a Remote Code Execution RCE via webshell. Recommendations: For PHPGurukul Job Porta...

PT-2024-40292 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: A broken access control issue has been discovered in the Import/Export module, allowing regular backend users to access import functionality that is typically restricted to admin users or tho...

[SECURITY] [DSA 5685-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5685-1 [email protected] https://www.debian.org/security/ Markus Koschany May 08, 2024 https://www.debian.org/security/faq -...

moziloCMS 安全漏洞

moziloCMS is an open source content management system CMS. It is primarily aimed at users with little knowledge of HTML and is impressive for its beginner-friendly operation. A security vulnerability exists in version v2.0 of moziloCMS, which stems from a vulnerability that allows an attacker to...

PT-2024-22868 · Mozilocms · Mozilocms

Name of the Vulnerable Software and Affected Versions: moziloCMS version 2.0 Description: The issue allows attackers to bypass file upload restrictions, potentially leading to unauthorized file execution or storage of malicious content. This is achieved by renaming files, which can result in the...

phpMyFAQ's File Upload Bypass at Category Image Leads to RCE

Summary The category image upload function in phpmyfaq is vulnerable to manipulation of the Content-type and lang parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution RCE on the system. Details In the file upload function of...