CVE-2024-46441

An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php called from app/admin/controller/ypay/Home.php. The file extension of an uncompressed file is not checked...

CVE-2024-8126 Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'classfmaconnector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an...

EUVD-2024-48637

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

File Upload Vulnerability in Sailsoft Reports by Sailsoft Software Ltd.

Fansoft Reporting is a pure Java written , data display report and data entry form functions in one enterprise-class web reporting tools . A file upload vulnerability exists in FanSoft Reports, which can be exploited by attackers to gain server privileges...

CVE-2023-26690

File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu...

WordPress OneElements – Best Elementor Addons plugin <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin OneElements – Best Elementor Addons versions = 1.3.7...

Exploit for Unrestricted Upload of File with Dangerous Type in Mayurik Best_House_Rental_Management_System

CVE-2024-46377 PoC for Arbitrary File Upload Vulnerability...

Exploit for Path Traversal in Tuzitio Camaleon_Cms

CVE-2024-46986 Camaleon CMS Exploit - Arbitrary File Upload...

PT-2024-31909 · Unknown · Gdidees Cms

Name of the Vulnerable Software and Affected Versions: GDidees CMS versions 3.9.1 and earlier Description: A file upload vulnerability exists in the software. This issue allows for malicious file uploads, potentially leading to security breaches. Recommendations: For versions 3.9.1 and earlier,...

CVE-2024-46373

Dedecms DedeCMS V5.7.115 is affected by a backend file upload vulnerability that enables arbitrary code execution. The issue stems from a backend file upload path that can be abused to execute uploaded code, enabling an attacker to run commands with the system’s privileges. The documentation cons...

CVE-2024-45398 Remote command execution through file upload in contao/core-bundle

Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does...

PT-2024-9684

Name of the Vulnerable Software and Affected Versions Backup and Staging by WP Time Capsule plugin for WordPress versions up to, and including, 1.22.21 Description The issue is related to arbitrary file uploads due to missing file type validation in the UploadHandler.php file and no direct file...

File Upload Vulnerability in Founder Mobile Editorial of Beijing Beifang Founder Electronics Co.

Beijing Founder Electronics Co., Ltd. is a leading provider of technology, products and services in the field of cross-media information communication. A file upload vulnerability exists in Founder Mobile Editorial of Beijing Founder Electronics Co., Ltd, which can be exploited by attackers to...

Risky Deserialization Calls - benryanconversion ( Office Connector Plugin)

The benryanconversion plugin contains a code path that eventually ends up with a partially user-controlled filename being treated as the input for a call to readObject see FileBackedCache.loadFile. To trigger this, an attacker would need to call the following, with a payload in the sheetName...

PT-2024-31278 · Qualitor · Qualitor

Name of the Vulnerable Software and Affected Versions: Qualitor versions up to 8.24 Description: The issue concerns Remote Code Execution RCE via Arbitrary File Upload in the checkAcesso.php file. This allows for the execution of remote code, potentially leading to unauthorized access and control...

IBM webMethods Integration File Upload Vulnerability

IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. A file upload vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an authenticated attacker to upload and execute arbitrary files that can be executed on the...

CVE-2024-42991

MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution...

PPDB 2.4-update 6118-1 Cross Site Request Forgery

============================================================================================================================================= | Title : ppdb v2.4-update 6118-1 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | ...

MingSoft MCMS 安全漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingFei MingSoft. A security vulnerability exists in MingSoft MCMS version v5.4.1, which stems from improper handling of the front-end file upload function, and could lead to remote command execution...

Kashipara Hotel Management System File Upload Vulnerability

Kashipara Hotel Management System is a hotel management system from Kashipara. A file upload vulnerability exists in Kashipara Hotel Management System v1.0, which stems from the lack of validation of uploaded files in /admin/addroomcontroller.php, and can be exploited by an attacker to upload a...