DuxCMS 代码问题漏洞

DuxCMS is an open source content management system. A security vulnerability exists in DuxCMS version 2.1, which stems from a file upload vulnerability that allows an attacker to execute arbitrary php code via duxcms/AdminUpload/upload...

Yoga Class Registration System 代码问题漏洞

Yoga Class Registration System is a yoga class registration system. A file upload vulnerability exists in Yoga Class Registration System v1.0, which stems from the application's inability to properly validate class thumbnails uploaded by administrators, and can be exploited by an attacker with...

FeehiCMS 代码问题漏洞

FeehiCMS is a Php-based CMS builder. FeehiCMS version 2.0.8 has an arbitrary file upload vulnerability that can be exploited by remote attackers to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component...

ThinkAdmin 代码问题漏洞

ThinkAdmin is a general-purpose backend management system based on ThinkPHP framework. ThinkAdmin v6 version has a security vulnerability, the vulnerability stems from /api/upload.php in the existence of arbitrary file upload vulnerability, an attacker can be constructed through the file to execu...

CVE-2023-34944

An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11. up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file...

Kramer VIA GO² 代码问题漏洞

The Kramer VIA GO² is a 4K wireless presentation device from Kramer. A security vulnerability exists in KramerAV VIA GO² versions prior to 4.0.1.1326 that stems from vulnerability to unauthenticated file uploads, which can lead to remote code execution RCE...

CVE-2023-24834

WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL...

Cisco Webex 跨站脚本漏洞

Cisco Webex is a suite of videoconferencing and collaboration products from Cisco USA. A cross-site scripting vulnerability exists in the Cisco Webex App that stems from insufficient validation of user-supplied input and a file upload vulnerability that can be exploited by an attacker to conduct...

Zulip 安全漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. for combining the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in Zulip that stems from the ability to upload a file with an arbitrary Content-Type, whi...

Purchase Order Management System 代码问题漏洞

Purchase Order Management System is a Purchase Order Management System by Carlo Montero Personal Developer. A code issue vulnerability exists in Purchase Order Management System v1.0, which was discovered via /purchaseorder/admin/?page=systeminfo contains a file upload vulnerability...

Billing System Project 代码问题漏洞

Billing System Project is a billing system project by Mayuri K. Individual developer. A security vulnerability exists in Billing System Project v1.0, which stems from an arbitrary file upload vulnerability found in component /phpaction/editProductImage. An attacker can exploit this vulnerability ...

CVE-2022-41520

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function...

LDAP Account Manager 代码问题漏洞

LDAP Account Manager is a web front-end for managing entries stored in LDAP directories e.g., users, groups, DHCP settings. file upload vulnerability exists in LDAP Account Manager LAM versions prior to 8.0, which stems from a faulty regular expression that allows PHP scripts to be uploaded to th...

CVE-2022-26974

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization in the upload mechanism leads to reflected XSS...

MingSoft MCMS 代码问题漏洞

MCMS is a java-based development of a lightweight open source content management system . Jiangxi Mingsoft Technology Co., Ltd MCMS file upload vulnerability, an attacker can use the vulnerability to obtain control of the server...

PT-2022-9782 · Maxboard · Maxboard

Name of the Vulnerable Software and Affected Versions: Maxboard affected versions not specified Description: The issue allows for SQL injection and file upload attacks due to insufficient validation of input values in some parameters and variables of files, which may lead to arbitrary code...

GHSA-274R-P6V6-FHH4 Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

Cross-site request forgery CSRF vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability...

novel-plus 代码问题漏洞

novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. Novel-plus has a file upload vulnerability, which originates from the lack of file upload restrictions in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java. An...

WordPress plugin Tatsu 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A file upload vulnerability...

Zimbra Collaboration Suite 路径遍历漏洞

Zimbra Collaboration aka ZCS versions 8.8.15 and 9.0 are vulnerable to a file upload vulnerability that stems from a lack of valid authentication of uploaded files by the application. An authenticated attacker with administrator privileges could exploit the vulnerability to be able to upload...