Church Management System SQL注入漏洞

Church Management System is a church management system. version 1.0 of Church Management System is vulnerable to a file upload vulnerability that results from a lack of validation of uploaded files by the application. An attacker could exploit this vulnerability to upload malicious files to...

CVE-2022-31483

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contai...

Design/Logic Flaw

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contai...

CVE-2022-30506

An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file...

Privilege escalation

In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "usersprofile.php" file...

CVE-2022-24239

CVE-2022-24239 affects ACEweb Online Portal 3.5.065, with an unrestricted file upload vulnerability via attachments.awp. The vulnerability is documented across multiple sources (NVD, Red Hat, PRION, CNNVD, CVE list) and is rated with a high/critical impact (CVSS v3.1 base score 9.8, network attac...

CVE-2022-29637

CVE-2022-29637 affects Mindoc v2.1-beta.5, where an arbitrary file upload vulnerability in the Unzip/ZIP handling allows an attacker to execute arbitrary commands through a crafted Zip file. Multiple sources (Veracode and Snyk entries referencing Mindoc’s unzip/ziptil code paths) describe the iss...

Formstone Vulnerable to Reflected XSS

Formstone =1.4.16 is vulnerable to a Reflected Cross-Site Scripting XSS vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in...

CVE-2021-42654

SiteServer CMS

File upload vulnerability exists in the security management system of Centrin JingYun terminal of Beijing Centrin Link Information Technology Co.

Ltd. is a company whose business scope includes Internet information services; technology development, technology services, technology transfer, technology consulting, etc. Beijing Centrin Link Information Technology Co., Ltd. Centrin King Cloud Terminal Security Management System has a file uplo...

SiteServer CMS 代码问题漏洞

SiteServer CMS is an open-source content management system CMS from China's BioRenewable Software Technology Development Corporation. A security vulnerability exists in SiteServer CMS prior to version V5.1, which is caused by the unrestricted upload of a dangerous type of file getshell that can b...

Publify 代码问题漏洞

Publify is a simple but full-featured web publishing software.An arbitrary file upload vulnerability exists in versions of Publify prior to 9.2.9, which stems from the application's lack of validation of uploaded files. An attacker could exploit this vulnerability to upload malicious files to...

Remote Code Execution (RCE)

formidable is vulnerable to remote code execution. The vulnerability exists due to the lack validation in the upload file, allowing an attacker to inject and execute malicious code via crafted filename...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the file upload functionality. An attacker can execute arbitrary code by uploading a file with a crafted extension and then accessing it through unspecified vectors. Remediation Upgrade in2code/powermail to...

GHSA-49MJ-77Q5-QW5G Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

Stored Cross-site scripting XSS vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality...

GXCMS15 代码问题漏洞

GXCMS15 is a CMS by breezety personal developer. A security vulnerability exists in GXCMS15 version 1.5, which stems from a file upload vulnerability...

novel-plus file upload vulnerability

novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. Novel-plus has a file upload vulnerability, which originates from the lack of file upload restrictions in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java. An...

CVE-2022-29353

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

CVE-2022-29623

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

Gogs Directory Traversal

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...