5510 matches found
CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress
A vulnerability in the file upload functionality of the FlatPress CMS admin panel version latest allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting XSS attack if the uploaded file is accessed by other users. The issue is...
CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress
A vulnerability in the file upload functionality of the FlatPress CMS admin panel version latest allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting XSS attack if the uploaded file is accessed by other users. The issue is...
CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress
A vulnerability in the file upload functionality of the FlatPress CMS admin panel version latest allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting XSS attack if the uploaded file is accessed by other users. The issue is...
CVE-2024-10902
CVE-2024-10902 concerns eosphoros-ai/db-gpt v0.6.0. The web API endpoint POST /v1/personal/agent/upload is described as vulnerable to Arbitrary File Upload with Path Traversal , enabling an attacker to upload files to arbitrary locations on the victim’s file system. Impact telegraphs possible rem...
CVE-2024-10831 Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the filekey and docfile.filename parameters are...
CVE-2024-10831 Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the filekey and docfile.filename parameters are...
CVE-2024-10831 Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the filekey and docfile.filename parameters are...
CVE-2024-10831
CVE-2024-10831 — Normal (detailed): In eosphoros-ai/db-gpt version 0.6.0, the file-upload endpoint is vulnerable to absolute path traversal. The vulnerability arises because file_key and doc_file.filename are user-controllable, enabling an attacker to construct paths outside the intended director...
CVE-2024-9415 Path Traversal in transformeroptimus/superagi
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server...
CVE-2024-9415 Path Traversal in transformeroptimus/superagi
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server...
CVE-2024-10225 Denial of Service in haotian-liu/llava
A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service DoS by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously process each character, rendering the application...
Stable Diffusion web UI 资源管理错误漏洞
Stable Diffusion web UI is a web interface for AUTOMATIC1111 individual developers. A resource management error vulnerability exists in Stable Diffusion web UI version 1.10.0, which stems from improper handling of form-data in a file upload request and could lead to a denial of service attack...
PT-2025-12149 · Unknown · Netease-Youdao/Qanything
Name of the Vulnerable Software and Affected Versions: netease-youdao/qanything version v2.0.0 Description: A Denial of Service DoS vulnerability exists in the file upload feature due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this ...
iBanking 安全漏洞
iBanking is an information system by Martin Mbithi Personal Developer. A security vulnerability exists in iBanking version v2.0.0, which stems from an arbitrary file upload vulnerability in the Client Profile Update section that could lead to the execution of arbitrary code...
CVE-2025-2512 File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function
The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on t...
CVE-2024-45644 IBM Security ReaQta file upload
IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment...
CVE-2024-45644 IBM Security ReaQta file upload
IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment...
CVE-2024-45644
CVE-2024-45644 affects IBM Security ReaQta 3.12 (and IBM QRadar EDR context in IBM bulletin). The issue stems from insufficient validation of uploaded files, enabling a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product environmen...
Cross-site Scripting (XSS)
Overview contao/core-bundle is an Open Source PHP Content Management System for people who want a professional website that is easy to maintain. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the uploadTo function in FileUpload.php. An attacker can execute scripts...