5553 matches found
CVE-2007-0505
Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue...
CVE-2007-0370
Unrestricted file upload vulnerability in index.php in phpBP RC3 2.204 and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an imageform parameter specifying a multiple-extension filename...
CVE-2007-0370
CVE-2007-0370 describes an unrestricted file upload in index.php of phpBP RC3 (2.204) and earlier. A remote attacker can inject arbitrary PHP code into upload/banners/ by uploading a crafted filename (e.g., .jpg.vil.gif.php) via a banners add operation, causing the code to be stored under a diffe...
CVE-2007-0082
This entry covers CVE-2007-0082 affecting IMGallery 2.5 and earlier. The vulnerability occurs in users_adm/start1.php where files with multiple extensions are not properly handled, allowing remote authenticated users to upload and execute arbitrary PHP scripts. The documented impact is partial co...
CVE-2006-4581
Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts...
CVE-2006-6887
Unrestricted file upload vulnerability in logahead UNU 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to plugins/widged/widged.php aka the WidgEd plugin, a different vulnerability than CVE-2006-6783. NOTE: The provenance of this information is...
CVE-2006-6556
The CVE-2006-6556 entry affects EyeOS (EyeHome function in apps/eyeHome.eyeapp/aplic.php) prior to 0.9.3-3. An attacker can remotely upload and execute arbitrary code by using dangerous file extensions that are not all lowercase, which bypasses the input cleansing step. This results in remote cod...
CVE-2006-6463
Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root...
CVE-2006-6463
Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root...
CVE-2006-6463
The CVE-2006-6463 entry concerns Midicart’s admin/add.php, where an unrestricted file upload vulnerability exists. According to PT-2006-7072, remote authenticated users can upload arbitrary files (potentially including .php) to the images/ directory under the web root via the admin/add.php endpoi...
phpcms 3.0.0文件上传漏洞
漏洞文件: ads/upload.php、uppic.php require PHPCMSROOT."/class/upload.php"; if!$userid message"请您先登录或注册！" , PHPCMSPATH."member/login.php"; if$extid==1 $upfiletype= "jpg|png|gif"; elseif $extid==2 $upfiletype= "swf"; if$action=='upload' $fileArr = array 'file'=$uploadfile, 'name'=$uploadfilename,...
CVE-2006-6347
Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...
CVE-2006-6338
Unrestricted file upload vulnerability in upload/index.php in deV!Lz Clanportal DZCP before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/...
CVE-2006-6347
Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...
CVE-2006-6338
CVE-2006-6338 : Unrestricted file upload in the PHP script upload/index.php of the DZCP (deV!L`z Clanportal) prior to 1.3.6.1. An attacker can embed PHP code in a JPEG/GIF uploaded to inc/images/uploads/userpics/ and trigger remote code execution. The connected sources confirm the vulnerability p...
CVE-2006-6347
CVE-2006-6347 concerns TFT Gallery 0.10. It allows an unrestricted file upload by remote authenticated administrators (to upload arbitrary .php files, potentially via admin/index.php). The vulnerability can be combined with CVE-2006-1412 to yield a remote unauthenticated vector. Base metrics indi...
CVE-2006-5845
Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the upload parameter to 1...
CVE-2006-5833
gbcmsphpfiles/uploader.php GreenBeast CMS 1.3 does not require authentication to upload files, which allows remote attackers to cause a denial of service disk consumption and execute arbitrary code by uploading arbitrary files, such as executing PHP code via an uploaded PHP file...