Unrestricted file upload

File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php...

CVE-2021-36573

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload...

PT-2022-8621 · Unknown · Zhimengzhe Ibarn

Name of the Vulnerable Software and Affected Versions: zhimengzhe iBarn version 1.5 Description: The issue allows remote attackers to run arbitrary code via avatar upload to "index.php". This is due to a file upload vulnerability in the upload function in action/Core.class.php. Recommendations: F...

CVE-2022-4506 Unrestricted Upload of File with Dangerous Type in openemr/openemr

Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2020-20588

File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php...

CVE-2021-36573

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload...

Design/Logic Flaw

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

PT-2022-25014 · WordPress · Appointment Booking System

Name of the Vulnerable Software and Affected Versions: Appointment Booking System WordPress plugin versions prior to 3.2.2 Description: The issue allows unauthenticated users to upload arbitrary files, such as PHP, which could achieve Remote Code Execution RCE due to a lack of validation for...

PT-2022-6295 · Unknown · Apex-Vuz Automation System

Name of the Vulnerable Software and Affected Versions: Apex-VUZ automation system affected versions not specified Description: The issue is related to the messaging component of the custom file upload module in the Apex-VUZ automation system. It involves the unrestricted upload of dangerous file...

CVE-2022-45759

SENS v1.0 has a file upload vulnerability...

SENS 代码问题漏洞

SENS is an enterprise blog system by saysky individual developer. A code issue vulnerability exists in SENS v1.0, which stems from the presence of a file upload vulnerability...

CVE-2022-45968

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder even a password protected one...

CVE-2022-42458

Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered...

CVE-2022-44289

Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell...

CVE-2022-36431

Summary (validated): CVE-2022-36431 affects Rocket TRUfusion Enterprise prior to 7.9.6.1. An unauthenticated attacker can upload a crafted JSP file to achieve arbitrary code execution due to an arbitrary file upload vulnerability. The issue is fixed in version 7.9.6.1. Affected software: Rocket T...

Contec SolarView Compact 代码问题漏洞

Contec SolarView Compact is an application system from Contec Japan. It provides photovoltaic power generation measurement system. A file upload vulnerability exists in Contec SolarView Compact versions 4.0 and 5.0. The vulnerability stems from the application's lack of effective validation of...

CVE-2022-44400

Purchase Order Management System v1.0 contains a file upload vulnerability via /purchaseorder/admin/?page=systeminfo...

PT-2022-27212 · Unknown · Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability. This vulnerability can be exploited via the /tour/admin/file.php API endpoint. Recommendations: For Online Tours &...

CVE-2022-44400

Purchase Order Management System v1.0 contains a file upload vulnerability via /purchaseorder/admin/?page=systeminfo...

Online Tours & Travels Management System 代码问题漏洞

Online Tours & Travels Management System is an online tour management system by Mayuri K. Individual developer. A code issue vulnerability exists in Online Tours & Travels Management System v1.0, which was discovered to contain a file upload vulnerability via /tour/admin/file.php...