PT-2024-22434 · Twenty · Twenty

Name of the Vulnerable Software and Affected Versions: Twenty version 0.3.0 Description: The CRM platform is vulnerable to stored cross-site scripting via file upload. A crafted svg file can trigger the execution of the javascript code. Recommendations: For version 0.3.0, consider disabling the...

CVE-2024-28441

File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint...

PT-2024-2363 · Ivanti · Ivanti Itsm

Name of the Vulnerable Software and Affected Versions: Ivanti ITSM versions prior to 2023.4 Description: The issue is related to an file upload vulnerability, which allows an authenticated remote user to perform file writes to the server. This can lead to the execution of commands in the context ...

74CMS File Upload Vulnerability

74CMS is an online recruitment system based on PHP and MySQL. A file upload vulnerability exists in version 3.28.0 of 74CMS, which stems from the lack of valid validation of the uploaded file by imgBase64, a parameter of the function sendCompanyLogo in file /controller/company/Index.php. The...

PYSEC-2024-314

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

CVE-2024-28418

Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/wecmd.php...

CVE-2024-26503

The CVE-2024-26503 entry concerns Unrestricted File Upload in Greek Universities Network Open eClass v3.15 and earlier, enabling remote code execution by uploading a crafted file to certbadge.php. Affected component: certbadge.php upload handling in Open eClass platforms. Impact: attacker can run...

PT-2024-22423 · Unknown · Webedition Cms

Name of the Vulnerable Software and Affected Versions: Webedition CMS version 9.2.2.0 Description: The issue is related to a File upload vulnerability. This vulnerability can be exploited via the /webEdition/we cmd.php API endpoint. Recommendations: For Webedition CMS version 9.2.2.0, as a...

CVE-2024-1527 Unrestricted Upload of File with Dangerous Type in CMS Made Simple

Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell...

Malware Campaign Exploits Popup Builder WordPress Plugin to Infect 3,900+ Sites

A new malware campaign is leveraging a high-severity security flaw in the Popup Builder plugin for WordPress to inject malicious JavaScript code. According to Sucuri, the campaign has infected more than 3,900 sites over the past three weeks. "These attacks are orchestrated from domains less than ...

SAP NetWeaver 代码注入漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A file upload vulnerability exists in SAP NetWeaver, which stems from the application's lack of effective...

PT-2024-20019 · Zoho · Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: ManageEngine Desktop Central version 9, build 90055 Description: A critical flaw in ManageEngine Desktop Central poses a major security risk due to an unrestricted file upload vulnerability. This issue could allow a remote attacker to upload ...

PT-2024-19217 · Sap · Sap Netweaver Administrator As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Administrator AS Java Administrator Log Viewer plug-in version 7.50 Description: The issue allows an attacker with high privileges to upload potentially dangerous files, which leads to a command injection vulnerability. This wou...

Exploit for CVE-2024-27697

FuguHub 8.4 Authenticated RCE Fuguhub is a Cloud Media Serve...

CVE-2024-27733

File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component...

BIT-SOLR-2023-50386 Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected...

CVE-2024-27747

Petrol Pump Management Software v1.0 (vendor mayuri_k) contains a file-upload vulnerability in profile.php via the Image parameter in the email field, enabling remote code execution. Root cause: insufficient validation of uploaded content allows uploading a PHP shell (as shown by PoCs) which can ...

File Upload Vulnerability in Teaching Management System of Hunan Qiangzhi Technology Development Co.

Hunan Strong Intelligence Technology Development Co., Ltd. is a domestic university informatization service provider and national high-tech enterprise. A file upload vulnerability exists in the Academic Affairs Management System of Hunan Qiangzhi Science and Technology Development Co...

IBM Security Guardium Security Vulnerabilities

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A security vulnerability exists in IBM Security Guardium Ke...

CVE-2023-6585

The CVE-2023-6585 issue affects the WP JobSearch WordPress plugin prior to version 2.3.4. The vulnerability stems from inadequate validation of uploaded files, allowing unauthenticated attackers to upload arbitrary files (e.g., PHP) to the server, potentially enabling remote code execution. The i...