CVE-2022-38323

Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /RoyalEvent/updateimage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-24367 · Unknown · Event Management System

Name of the Vulnerable Software and Affected Versions: Event Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the /Royal Event/update image.php component. Recommendations: F...

CVE-2022-36667

Garage Management System 1.0 is vulnerable to the Remote Code Execution RCE due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the attacker can upload PHP Reverse Shell straight away to gain RCE...

PT-2022-22693 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: The issue allows an attacker with basic business user privileges to craft and upload a malicious file, which is then downloaded and viewed by other users,...

Design/Logic Flaw

Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager...

畅捷通T+安全漏洞

Changjitong T+ is an Internet-based enterprise management system from China's Changjitong Company, featuring business management, order tracking, funding, inventory, and other functions. An unauthorized attacker can upload malicious files through the exposed web service interface of Changjitong T...

CVE-2022-36582

An arbitrary file upload vulnerability in the component /phpaction/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-37159

Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload...

PT-2022-17611 · WordPress · Advanced Custom Fields Pro

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields WordPress plugin versions prior to 5.12.3 Advanced Custom Fields Pro WordPress plugin versions prior to 5.12.3 Description: The issue allows unauthenticated users to upload files, limited to those allowed in a default...

CVE-2022-2381

The CVE covers the WordPress plugin E Unlocked - Student Result (

PT-2022-15138 · WordPress · Greyd.Suite

Name of the Vulnerable Software and Affected Versions: GREYD.SUITE WordPress theme affected versions not specified Description: The issue concerns the GREYD.SUITE WordPress theme, which fails to properly validate uploaded custom font packages and does not perform authorization or CSRF checks. Thi...

CVE-2022-37042

Zimbra Collaboration Suite ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication i.e., not having an authtoken, an attacker can upload arbitrary files to the system, leading to directory traversal and remote code...

Simple Online Book Store System 代码问题漏洞

Simple Online Book Store System is a simple online bookstore system by Carlo Montero Personal Developer. Simple Online Book Store System has a code issue vulnerability that stems from unknown code in its Admin add.php component that could lead to an unrestricted upload by a remote attacker...

CVE-2022-35697 AEM File Upload Security Issue leading to RXSS

Adobe Experience Manager Core Components version 2.20.6 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

PT-2022-16075

Name of the Vulnerable Software and Affected Versions Frontend File Manager & Sharing WordPress plugin versions prior to 1.1.3 Description The issue allows users to upload files without proper filtering of file extensions, potentially leading to the upload of malicious code. Recommendations For...

CVE-2022-34154 WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability

Authenticated author or higher user role Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin = 1.0.1 at WordPress...

CVE-2022-34496

Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature...

CVE-2022-34496

Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature...

CVE-2022-34971

CVE-2022-34971 describes an arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1. The root cause is insufficient validation of uploaded files, allowing a crafted PHP file to be uploaded and executed, enabling remote code execution. The severity is high (CVS...

PT-2022-22467 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: Feehi CMS version 2.1.1 Description: An arbitrary file upload vulnerability in the Advertising Management module allows attackers to execute arbitrary code via a crafted PHP file. Recommendations: For Feehi CMS version 2.1.1, consider disabli...