5523 matches found
Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal
- The plugin did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector. - Path Traversal Vulnerabillity also allows listing the entire folder & image file in the system. - The below...
CVE-2023-25909
HGiga OAKlouds has a file upload function that does not restrict dangerous file types, enabling an unauthenticated remote attacker to upload and execute arbitrary executables and disrupt service. Multiple sources (NVD, CVE listings, and related reports) describe this as an arbitrary file upload f...
Hgiga Oaklouds 代码问题漏洞
Hgiga Oaklouds is an enterprise collaborative work portal network of China Henderson Technology Hgiga Company. It is used for just-in-time communication and resource reservation. A code issue vulnerability exists in HGiga OAKlouds version v2 and v3. The vulnerability stems from the presence of a...
CVE-2023-24834 WisdomGarden Tronclass ilearn - Broken Access Control
WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL...
CVE-2023-28435 Dataease file upload interface does not verify permission or file type
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has bee...
CVE-2020-19786
File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file...
CVE-2020-19786
File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file...
Unrestricted file upload
File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file...
CVE-2023-25655 baserCMS allows any file to be uploaded
baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch...
CVE-2020-19786
File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file...
CVE-2020-19786
File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file...
baserCMS 代码问题漏洞
baserCMS is an Enterprise Content Management System CMS from the baserCMS team. A code issue vulnerability exists in versions of baserCMS prior to 4.7.5 that stems from the presence of a file upload vulnerability...
PHAR deserialization allowing remote code execution
Description snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the fileexists function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitra...
Snappy 代码问题漏洞
Snappy is a PHP library from the individual developers at KNP Labs that allows thumbnails, snapshots or PDFs to be generated from url or html pages. A code issue vulnerability exists in versions of Snappy prior to 1.4.2 that stems from a lack of protocol checks. An attacker can exploit this...
CVE-2023-0350 CVE-2023-0350
Akuvox E11 does not ensure that a file extension is associated with the file provided. This could allow an attacker to upload a file to the device by changing the extension of a malicious file to an accepted file type...
CVE-2023-0477
CVE-2023-0477 affects the WordPress plugin Auto Featured Image (Auto Post Thumbnail)
CVE-2023-23328
A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file...
Unrestricted file upload
A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file...