CVE-2021-46113

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

ForestBlog 代码问题漏洞

ForestBlog is an application. A personal blog A security vulnerability exists in ForestBlog that stems from a security issue where file uploads bypass authentication...

Static Code Injection in gibbonedu/core

Description The file export.php accepts a directory in the q parameter. We can upload a txt file in the server with our php exploit on it and pass its location in the q parameter, then the php exploit in the uploaded txt file will be executed Proof of Concept 1. Upload a txt file. Inside the txt...

CVE-2022-23315

MCMS v5.2.4 is affected by an arbitrary file upload vulnerability in the component /ms/template/writeFileContent.do. The root cause, as described across connected sources, is insufficient validation/filtration of uploaded file types, enabling attackers to upload arbitrary files. This impacts conf...

in microweber/microweber

Description Sensitive information as part of the error is getting disclosed during the upload of an unrestricted file. Steps to Reproduce Instance 1 1. Log in to the application https://demo.microweber.org 2. Add a new post and upload an SVG file and you will see an error message getting Popped o...

Saraban 代码问题漏洞

Saraban is a file management system from Softvibe Thailand. It is used to transfer files and notifications to reduce unnecessary duplication.A file upload vulnerability exists in Saraban, which stems from the application's file upload feature that does not properly perform access control and file...

File Upload Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd (CNVD-2022-10322)

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A file upload vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Limited, which can be exploited by attackers to gain control of the server...

File Upload Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd.

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A file upload vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Co. Ltd, which can be exploited by an attacker to gain control of the server...

CVE-2022-22530

CVE-2022-22530 affects the SAP S/4HANA F0743 Create Single Payment application (versions 100–106). The issue is improper validation of uploaded/downloaded files, enabling a user with basic rights to inject dangerous content or malicious code, potentially modifying critical information and comprom...

October CMS 代码代码注入漏洞

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A file upload vulnerability exists in October CMS, which stems from the "Create, Modify, and Delete Site Pages" privilege of the management system, and can be exploited by an attacker t...

Sourcecodester Vehicle Service Management System文件上传漏洞（CNVD-2022-09798）

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple web application for automotive repair/service stores or businesses. Sourcecodester Vehicle Service Management System suffers from a file upload vulnerability that can be exploited by attackers to upload...

Unrestricted file upload

Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious php file in multiple endpoints it leading to Code Execution...

Sourcecodester Vehicle Service Management System 代码问题漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple web application for automotive repair/service stores or businesses. Sourcecodester Vehicle Service Management System suffers from a file upload vulnerability that can be exploited by attackers to upload...

Sourcecodester Vehicle Service Management System 代码问题漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple web application for automotive repair/service stores or businesses. Sourcecodester Vehicle Service Management System suffers from a file upload vulnerability that can be exploited by attackers to upload...

Exploit for Unrestricted Upload of File with Dangerous Type in Embedthis Goahead

CVE-2021-42342 CVE-2021-42342 RCE POC1:just prints c in...

PT-2023-14714 · Debian · Debian

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue involves multiple problems: Server Side Request Forgery SSRF, persistent Cross-site Scripting XSS, and a File upload vulnerability. SSRF allows an attacker to trick the server in...

Zoho ManageEngine ADManager Plus Arbitrary File Upload (CVE-2021-20130)

An unrestricted file upload vulnerability exists in ManageEngine ADManager Plus. The vulnerability is due to lack of validation of uploaded files in PasswordExpiryAction class...

Wiki.js 跨站脚本漏洞

Wiki.js is a suite of open source Wiki software based on Node.js and written in JavaScript by the Requarks.io team. Requarks Wiki.js suffers from a cross-site scripting vulnerability that stems from a script that uploads SVG files through a custom request using a forged MIME type. By creating a...

CVE-2021-23772 Arbitrary File Write

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder...

CVE-2021-44159

4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without authentication and execute arbitrary code in order to perform arbitrary system operations or deny of service attack...