iPublish AdPortal 代码注入漏洞

iPublish AdPortal is a self-service newspaper advertising platform from iPublish, Inc. A security vulnerability exists in iPublish AdPortal version 3.0.39, which stems from the presence of a file upload bypass that allows remote attackers to execute arbitrary code via the file upload feature...

Ovidentia 代码问题漏洞

Ovidentia is an open source content management system and collaboration platform based on PHP and MySQL from the French team Cantico, which can be used for publishing and managing projects, publication and article management, schedule sharing, and more. A security vulnerability exists in Ovidenti...

CVE-2024-53345

An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-56828

ChestnutCMS versions prior to 1.5.0 are vulnerable to a file upload flaw in the /api/member/avatar API endpoint. The memberService.uploadAvatarByBase64 method accepts a base64 string, extracts the content, and writes it to a file without validating the file extension derived from the suffix varia...

CVE-2024-56828

File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the...

CVE-2024-13141

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotel...

CVE-2024-13141

LightPicture (osuuu) up to v1.2.2 is affected by a cross-site scripting vulnerability in /api/upload of the SVG File Upload Handler, caused by unsanitized handling of the uploaded file parameter. The issue can be exploited remotely and has been publicly disclosed. The PT-2025-2027 entry recommend...

CVE-2024-55078

An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uploading a crafted file...

File Upload Vulnerability in CloudLink ERP Management System of Beijing Zhongke Shangsoft Software Co.

Ltd. is a high-tech software organization focusing on enterprise informatization construction. There is a file upload vulnerability in the CloudLink ERP management system of Beijing Zhongke Shangsoft Software Co., Ltd, which can be exploited by attackers to gain server privileges...

WukongCRM 安全漏洞

WuKong WukongCRM is a Customer Relationship Management CRM system from China Wukong WuKong. A security vulnerability exists in WukongCRM-11.0-JAVA version 11.3.3, which originates from an arbitrary file upload vulnerability in the /adminUser/updateImg component, which can be exploited to execute...

CVE-2024-56264 WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector acf-city-selector allows Upload a Web Shell to a Web Server.This issue affects ACF City Selector: from n/a through = 1.14.0...

CVE-2024-56249 WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through = 1.13.1...

CVE-2024-56046

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through = 1.9.9...

CVE-2024-56046

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through 1.9.9...

CVE-2024-56064 WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through = 2.3.3...

CVE-2024-56064

CVE-2024-56064 affects the WordPress plugin WP SuperBackup (indeed-wp-superbackup)

CVE-2024-56064 WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Azzaroco WP SuperBackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through 2.3.3...

CVE-2024-56046

CVE-2024-56046 affects WordPress plugin WPLMS (VibeThemes)≤1.9.9. The vulnerability is unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to the web server. Exploitation is possible without authentication. Documents from PT-Security and Patchstack corrob...