CVE-2023-23314

An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file...

Exploit for Unrestricted Upload of File with Dangerous Type in Webdesi9 File_Manager

Description The File Manager wp-file-manager plugin before...

CVE-2023-23607

erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they ca...

Privilege escalation

PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability...

PT-2023-15479 · Popojicms · Popojicms

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 2.0.1 Description: The issue concerns a file upload vulnerability in the backend plugin function. Recommendations: For PopojiCMS version 2.0.1, consider disabling the file upload functionality in the backend plugin as a...

PopojiCMS 代码问题漏洞

Electron Technologies FZC PopojiCMS is an open source content management system CMS based on the Popoji framework from Electron Technologies FZC, USA. A security vulnerability exists in PopojiCMS version v2.0.1, which stems from a file upload vulnerability in the back-end plugin functionality...

CVE-2022-47766

PopojiCMS v2.0.1 has a file upload vulnerability in the backend plugin function. The issue enables an attacker to upload files due to improper handling in the backend plugin, with CVSS v3.1 base score 8.8 (HIGH) and impact to confidentiality, integrity and availability. The vulnerability is docum...

PT-2023-14088 · Nvidia · Nvidia Bmc

Name of the Vulnerable Software and Affected Versions: NVIDIA BMC affected versions not specified Description: The issue concerns a vulnerability in the IPMI handler of NVIDIA BMC, allowing an authorized attacker to upload and download arbitrary files under certain circumstances. This may lead to...

CVE-2022-46610

72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-3416

The WPtouch WordPress plugin is affected: versions before 4.3.45 do not properly validate uploaded images, allowing high-privilege users (e.g., admins) to upload arbitrary files to the server (including in multisite setups). This is documented across multiple sources (Red Hat CVE entry, OpenVAS n...

PT-2023-13349 · WordPress · Wptouch

Name of the Vulnerable Software and Affected Versions: WPtouch WordPress plugin versions prior to 4.3.45 Description: The issue allows high privilege users, such as admins, to upload arbitrary files on the server, even when they should not be allowed to, for example in a multisite setup. This is...

Unrestricted File Upload

microweber/microweber is vulnerable to unrestricted file upload. The sanitization filter bypass in plupload.php allows a remote authenticated attacker to upload files outside the intended locations...

Easytest 代码问题漏洞

Easytest is an online learning quiz platform of China Huaqi Digital Technology Company. A security vulnerability exists in Easytest due to an insufficient filtering of special characters and file types in its File Upload feature, which allows remote attackers with normal user privileges to upload...

PT-2022-27789 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 2.5.1 Description: The issue allows users to upload a file without validating the file name, potentially leading to uploading files to any path if the file name in the upload request is falsified. This is due to ...

CVE-2022-4732 Unrestricted Upload of File with Dangerous Type in microweber/microweber

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2...

CVE-2022-4665 Unrestricted Upload of File with Dangerous Type in ampache/ampache

Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6...

CVE-2022-46493

CVE-2022-46493 affects the nbnbk default version, with an arbitrary file upload vulnerability exposed via the /api/User/download_img endpoint. The CVE is rated CVSS v3.1 base score 9.8 (CRITICAL), with network attack vector, no privileges required, and no user interaction; impacts to confidential...

CVE-2022-4061 JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload

The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP...

PT-2022-25418 · WordPress · Jobboardwp

Name of the Vulnerable Software and Affected Versions: JobBoardWP WordPress plugin versions prior to 1.2.2 Description: The issue allows unauthenticated users to upload arbitrary files, such as PHP, due to improper validation of file names and types in the file upload functionalities...

CVE-2022-46135

CVE-2022-46135 affects AeroCms v0.0.1. The vulnerability is an arbitrary file upload at /admin/posts.php?source=edit_post that enables uploading a webshell and taking control of the web server. Affected component is the upload endpoint in the admin/post editing flow; root cause details are consis...