5523 matches found
CVE-2023-27164
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file...
Design/Logic Flaw
An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a crafted ringtone file...
PT-2023-12206 · Wyomind · Wyomind Help Desk Magento 2 Extension
Name of the Vulnerable Software and Affected Versions: Wyomind Help Desk Magento 2 extension versions 1.3.6 and earlier Description: The issue allows an attacker to execute arbitrary code via a phar file upload in the ticket message field. This is achieved by exploiting a weakness in the...
CVE-2023-24282
The connected source CNNVD-202303-656 confirms a concrete vulnerability in Poly Trio 8800, version 7.2.2.1094, where an arbitrary file upload flaw can be exploited to execute arbitrary code via a crafted ringtone file. This defines the affected product/version and the root cause (unrestricted fil...
CVE-2023-22890
SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of service condition...
Input validation
The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for...
CVE-2022-4328 WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...
CVE-2023-25402
CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload...
CVE-2023-25402
CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload...
PT-2023-8667 · Unknown · Hgiga Oaklouds
Name of the Vulnerable Software and Affected Versions: HGiga OAKlouds affected versions not specified Description: The HGiga OAKlouds file uploading function does not restrict the upload of files with dangerous types. An unauthenticated remote attacker can exploit this issue to upload and run...
Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'Oracle E-Business Suite EBS Unauthenticated Arbitrary File Upload', 'Description' = %q This module exploits an unauthenticated...
Privilege escalation
An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file...
Unrestricted file upload
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page...
Unrestricted file upload
File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file...
CVE-2021-35290
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page...
PT-2023-12200 · Umbraco · Umbraco Forms
Name of the Vulnerable Software and Affected Versions: Umbraco Forms version 8.7.0 Description: The issue allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. This is a result of a file upload vulnerability. Recommendations: For Umbraco Forms version...
CVE-2023-24317
Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component editorganizer.php...
PT-2023-13736 · Unknown · Instantdeveloper Rd3
Name of the Vulnerable Software and Affected Versions: Instantdeveloper RD3 version 22.0.8500 Description: The issue allows attackers to execute arbitrary code due to a file upload vulnerability. Recommendations: For Instantdeveloper RD3 version 22.0.8500, at the moment, there is no information...
CVE-2022-39983
CVE-2022-39983 affects Pro Gamma Instant Developer RD3 (Instant Developer RD3) with versions 22.5 r23, r30 and possibly earlier. The vulnerability is a file upload issue that, per the sources, allows an attacker to execute arbitrary code. The connected documents do not provide an official patch/v...