CMS Made Simple 代码问题漏洞

CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple version...

CVE-2023-30185

CVE-2023-30185 affects CRMEB versions 4.4–4.6 and involves an arbitrary file upload vulnerability via the attachment/SystemAttachmentServices.php component. The issue is documented with a critical CVSS v3.1 score (9.8) affecting confidentiality, integrity, and availability. The connected sources ...

CVE-2020-22755

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943...

CVE-2020-22755

MCMS (MingSoft MCMS) is affected by CVE-2020-22755 due to an unrestricted file upload vulnerability in the thumbnail handling, enabling arbitrary code execution. Public references also describe a related issue in MCMS v5.2.8 (CVE-2022-31943) where an arbitrary file upload flaw exists, reinforcing...

CVE-2023-30122

An arbitrary file upload vulnerability in the component /admin/ajax.php?action=savemenu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2023-29635

CVE-2023-29635 affects Antabot White-Jotter v0.2.2. The issue is a file upload vulnerability where an attacker can supply a crafted file to the coversUpload function, enabling remote code execution. The CVSS 3.1 metrics indicate NETWORK attack vector, NONE privileges required, and high impact to ...

CVE-2023-29635

File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload...

CVE-2023-2419

CVE-2023-2419 affects Zhong Bang CRMEB 4.6.0, where the vulnerability is in the videoUpload function of SystemAttachmentServices.php. The root cause is manipulation of the filename argument that enables unrestricted file uploads. The issue can be triggered remotely and the exploit has been public...

CVE-2023-24269

Textpattern CMS v4.8.8 is affected by an arbitrary file upload vulnerability in the plugin upload function that enables remote code execution via a crafted Zip file. Root cause: insufficient validation of uploaded archives in the plugin upload workflow. CVE-2023-24269 is associated with this issu...

CVE-2023-28819

Concrete CMS (formerly concrete5) has a stored XSS vulnerability in uploaded file and folder names affecting versions 8.5.12 and older, and 9.0.0–9.0.2. Public advisories indicate fixes exist in 9.1+; earlier versions are vulnerable and may expose users to script execution via name fields. No exp...

CVE-2022-36769 IBM Cloud Pak for Data file upload

IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034...

CLTPHP 代码问题漏洞

CLTPHP is an open source PHP content management system for efficient website building. A security vulnerability exists in CLTPHP version 6.0 and earlier versions, which stems from the presence of a file upload vulnerability...

CVE-2023-26098

An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code...

CVE-2023-30613 Kiwi TCMS unrestricted file upload vulnerability

Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an .exe file or a file containing embedded...

PT-2023-21585 · Avalanche · Avalanche

Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An unrestricted upload of file with a dangerous type vulnerability exists that could allow an attacker to achieve remote code execution. Recommendations: For Avalanche versions 6.3.x and below,...

CVE-2023-25132

The CVE-2023-25132 vulnerability affects CyberPower PowerPanel Business family (Windows/Linux/macOS) with Local/Remote deployments prior to version 4.8.6. The issue is described as an unrestricted upload of a file with a dangerous type in the default.cmd file, enabling remote attackers to execute...

CVE-2023-1427 Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal

The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector...

CVE-2023-28962

The CVE-2023-28962 issue is a Junos OS J-Web vulnerability (upload-file.php) caused by improper authentication, enabling an unauthenticated, network-based attacker to upload arbitrary files to temporary folders. Affected products/versions include Juniper Networks Junos OS prior to 19.4R3-S11; 20....

CVE-2021-33990

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file...

PT-2023-12239 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal version 6.2.5 Description: The issue allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. The vendor disputes this issue because the exploit reference link only shows frmfolders.html is...