Privilege escalation

An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...

PSA: High Severity File Upload Vulnerability in Elementor Patched

On December 6, 2023, the Wordfence team noticed a changelog entry for version 3.18.1 of Elementor, a WordPress plugin installed on nearly 9 million sites. We did not discover the original vulnerability and only became aware of it after reviewing the changelog containing a partial patch. We...

Kopage Website Builder 4.4.15 Shell Upload

Title: Kopage-Website-Builder-4.4.15-File-Upload-RCE Author: nu11secur1ty Date: 12/08/2023 Vendor: https://www.kopage.com/ Software: https://demo.kopage.com/index.php Reference: https://portswigger.net/web-security/file-upload,...

CVE-2023-48930

xinhu xinhuoa 2.2.1 contains a File upload vulnerability...

CVE-2023-48930

xinhu xinhuoa 2.2.1 contains a File upload vulnerability...

CVE-2023-48930

xinhu xinhuoa 2.2.1 contains a File upload vulnerability...

PT-2023-31014 · Unknown · Xinhu Xinhuoa

Name of the Vulnerable Software and Affected Versions: xinhu xinhuoa version 2.2.1 Description: The issue is related to a File upload vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...

Cross site request forgery (csrf)

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server...

CVE-2022-45592

1 Server Side Request Forgery SSRF, 2 persistant Cross site scripting XSS, and 3 File upload vulnerability...

UBUNTU-CVE-2022-45592

1 Server Side Request Forgery SSRF, 2 persistant Cross site scripting XSS, and 3 File upload vulnerability...

CVE-2023-5636

Affected software: ArslanSoft Education Portal (before v1.1). Vulnerability type: Unrestricted Upload of File with Dangerous Type leading to Command Injection via file upload. Root cause / impact: Unrestricted file upload allows attacker to place and execute a dangerous file, enabling command exe...

ArslanSoft Education Portal Code Issue Vulnerability

ArslanSoft Education Portal is an education portal from ArslanSoft, Inc. A code issue vulnerability exists in versions prior to ArslanSoft Education Portal v1.1 that stems from the presence of a file upload vulnerability. An attacker can exploit this vulnerability to perform command injection by...

CVE-2023-49052

File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component...

CVE-2023-49052

File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component...

Cross site scripting

Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell...

PT-2023-28299 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.24 Description: The issue concerns an unrestricted file upload in the /main/inc/ajax/exercise.ajax.php endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by...

CVE-2023-29770

In CVE-2023-29770, Sentrifugo 3.5 is affected by a vulnerability in AssetsController::uploadsaveAction that allows an authenticated attacker to upload arbitrary files without extension filtering. The issue enables unauthenticated? No—authenticated attacker per description, with impact described a...

Sentrifugo security breach

Sentrifugo is a human resource management system. The system includes features for human resource management, performance appraisal, recruitment management, and asset management. A security vulnerability exists in Sentrifugo version 3.5 that stems from allowing an authenticated attacker to upload...

Artica Pandora FMS Security Vulnerability

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica Pandora FMS versions 700 through 773 that could allow an attacker to execute...

PT-2023-30411 · Headwind · Headwind Mdm Web Panel

Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue allows attackers to upload arbitrary files, including HTML files, to the server. When a victim downloads and opens one of these files, their browser renders the content as a web pag...