5523 matches found
phpKF CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated) Exploit
Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution RCE Unauthenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.phpkf.com/ Software Link: https://www.phpkf.com/indirme.php Version: 3.00 Category: Webapps Tested on: Linux/Windows phpKF-CMS; It is a very popula...
OpenCats 代码问题漏洞
OpenCats is an open source recruitment process management system. OpenCATS prior to 0.9.6 was vulnerable to file uploads, which stemmed from a lack of valid validation of uploaded files in the application's lib/FileUtility.php. A remote attacker could exploit this vulnerability to execute arbitra...
Design/Logic Flaw
fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access...
CVE-2021-43117
fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access...
CVE-2021-43117
The CVE-2021-43117 entry concerns fastadmin v1.2.1 and is linked to a file upload vulnerability that allows arbitrary code execution via shell access. The available connected sources corroborate the vulnerability in this specific version and describe the impact as remote arbitrary code execution....
fastadmin 代码问题漏洞
fastadmin is a set of ThinkPHP and Bootstrap-based web backend development framework. fastadmin has a security vulnerability that stems from the fact that Fastadmin v1.2.1 is affected by a file upload vulnerability that allows execution of arbitrary code via shell access. No details of the...
Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat
CVE-2017-12617 CVE-2017-12617 is a critical vulnerability lea...
CVE-2021-27984
In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files...
CVE-2021-36719 Cybonet - PineApp
PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a malicious file,Thus taking over the server and running remote code...
CVE-2021-27860 Arbitrary file upload vulnerability in FatPipe software
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006...
CVE-2021-42125
An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files...
CVE-2021-42125
An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files...
CVE-2021-23562
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
CVE-2021-23562
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
Design/Logic Flaw
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
Business-Dna Solution GmbH TopEase File Upload Vulnerability
Business-Dna Solution GmbH TopEase is a "Transformational Risk" solution from Business-Dna Solution GmbH, Switzerland. It is used to manage complex projects and initiatives comprehensively, simply, quickly and securely. A file upload vulnerability exists in Business-Dna Solution GmbH TopEase, whi...
Remote code execution
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...
CVE-2021-22968
Summary of CVE-2021-22968 (Concrete CMS / concrete5): A bypass in the File Manager’s external file upload allows remote code execution in Concrete CMS versions 8.5.6 and earlier. The feature stages uploaded files in the public directory even when their extensions are disallowed, storing them in a...
Unrestricted access to predictable file paths in hov/jobfair
An issue was discovered in the jobfair aka Job Fair extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded...