PT-2024-24450 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: jizhiCMS version 2.5 Description: The issue is related to a file upload vulnerability. Recommendations: For jizhiCMS version 2.5, update to a version that includes a fix for this issue, if available. At the moment, there is no information abo...

JIZHICMS 安全漏洞

Extreme Networks Technology JIZHICMS Extreme CMS is an open source content management system CMS from China's Extreme Networks Technology. A security vulnerability exists in JIZHICMS version 2.5, which stems from the presence of a file upload vulnerability...

CVE-2024-32256

Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a current package, there are no checks for what types of files are uploaded from the image...

PT-2024-24187 · Shibang Communications · Shibang Communications Co.

Name of the Vulnerable Software and Affected Versions: Shibang Communications Co., Ltd. IP network intercom broadcasting system version 1.0 Description: The issue allows a local attacker to execute arbitrary code via the my parser.php component. This is a result of a File Upload vulnerability in...

PT-2024-24473

Name of the Vulnerable Software and Affected Versions Phpgurukul Tourism Management System version 2.0 Description The issue allows for Unrestricted Upload of File with Dangerous Type via the "/tms/admin/change-image.php" API endpoint. When updating a current package, there are no checks for what...

File Upload Vulnerability in SuperMap iServer of Beijing SuperMap Software Co.

SuperMap iServer is a cloud GIS application server based on high-performance cross-platform GIS kernel, providing full-featured GIS service publishing, management and aggregation capabilities, and supporting multi-level extension development. A file upload vulnerability exists in SuperMap iServer...

CVE-2024-3803

CVE-2024-3803 affects Vesystem Cloud Desktop up to 20240408. The vulnerability resides in /Public/webuploader/0.1.5/server/fileupload.php, where manipulating the file parameter enables an unrestricted upload. The issue is exploitable remotely and the exploit has been publicly disclosed. Affected ...

Codoforum 安全漏洞

Codoforum is a PHP and MySQL based forum software. A security vulnerability exists in Codoforum version v4.9, which stems from an arbitrary file upload vulnerability that could allow an attacker to execute arbitrary code by uploading a crafted file...

PT-2024-19278 · Qdrant · Qdrant

Name of the Vulnerable Software and Affected Versions: qdrant/qdrant affected versions not specified Description: The issue is related to a path traversal and arbitrary file upload vulnerability via the "/collections/COLLECTION/snapshots/upload" endpoint, specifically through the snapshot...

File Upload Vulnerability in Zhiyuan A6-V5 Collaboration Management Software (CNVD-2024-22457)

Zhiyuan A6-V5 collaborative management software is a set of new generation of large collaborative office management software that can help various enterprises and institutions, government agencies and social groups of single-type organizations to achieve batch delivery. A file upload vulnerabilit...

Prison Management System add-admin.php File Upload Vulnerability

Prison Management System is a prison management system. A file upload vulnerability exists in Prison Management System version 1.0, which stems from a lack of validation of uploaded files in the avatar parameter of the /Admin/add-admin.php file. This vulnerability can be exploited to remotely...

CVE-2024-27665

Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting (XSS) through the file upload feature within the Syllabus module . An attacker can upload a file containing an XSS payload, which is then stored and executed on the server when accessed. Practical exploitation involves navigating ...

CVE-2024-3444

The CVE-2024-3444 issue affects Wangshen SecGate 3600 up to 20240408. The vulnerability resides in an upload endpoint parameter, specifically the file path parameter /?g=net_pro_keyword_import_save with the reqfile argument, where manipulation leads to unrestricted file upload. It is exploitable ...

Simple Car Rental System 代码问题漏洞

Simple Car Rental System is a simple car rental application. A code issue vulnerability exists in version 1.0 of Simple Car Rental System due to a file upload vulnerability in the parameter Upload Image of the file add-vehicle.php...

PT-2024-23631 · Unknown · Sourcecodester Complete E-Commerce Site

Name of the Vulnerable Software and Affected Versions: Sourcecodester Complete E-Commerce Site version 1.0 Description: The issue allows remote attackers to execute arbitrary code via the filename parameter in the "admin/products photo.php" endpoint. This is an arbitrary file upload vulnerability...

E-Commerce Site 安全漏洞

E-Commerce Site is an e-commerce website. A security vulnerability exists in Sourcecodester Complete E-Commerce Site v1.0, which stems from an arbitrary file upload vulnerability that can be exploited by an attacker to execute arbitrary code via the filename parameter in admin/productsphoto.php...

CVE-2024-31210 PHP file upload bypass via Plugin installer

WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins - Add New - Upload Plugin screen in WordPress. If FTP credentials are requested for installation in order to move...

CVE-2024-28520

The Byzoro Networks Smart multi-service security gateway intelligent management platform version S210 is impacted by a File Upload vulnerability. An attacker can exploit the uploadfile.php component to obtain sensitive information . As a temporary workaround, it is recommended to restrict access ...

Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)

Exploit Title: Wordpress Plugin - Membership For WooCommerce Resultz Uploader Uploaded ?PHP...

CVE-2024-31114

CVE-2024-31114 concerns the WordPress plugin group “Shortcode Addons” (Shortcode Addons: from n/a through 3.2.5). The connected exploit document confirms concrete technical details: an authenticated attacker with administrator-level access can abuse a missing file-type validation to perform an ar...