CVE-2022-43074

AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fstupload.inc.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-40797

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDENUPLOADS value in conf.json only blocks .php, .php4, and .php5 files. Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations...

CVE-2022-43050

Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component updateprofile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

Vehicle Booking System File Upload Vulnerability

Vehicle Booking System is a vehicle booking system. A file upload vulnerability exists in Vehicle Booking System v1.0, which can be exploited by an attacker to execute arbitrary code via a specially crafted php file...

Vehicle Booking System 代码问题漏洞

Vehicle Booking System is a vehicle booking system. A file upload vulnerability exists in Vehicle Booking System v1.0, which can be exploited by an attacker to execute arbitrary code via a specially crafted php file...

CVE-2022-33859 Unrestricted file upload in Eaton Foreseer EPMS

A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A threat actor may upload arbitrary...

CVE-2022-43275

Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/phpaction/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-26806 · Unknown · Canteen Management System

Name of the Vulnerable Software and Affected Versions: Canteen Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability. This is achieved through the API endpoint "/youthappam/manage...

PT-2022-25153 · Unknown · Online Pet Shop We App

Name of the Vulnerable Software and Affected Versions: Online Pet Shop We App version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point in the Editing function of the User module. This is achieved by exploiting a...

PT-2022-24888 · Unknown · Gin-Vue-Admin

Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.4 Description: The issue concerns an arbitrary file read due to insufficient validation of the fileMd5 and fileName parameters in the file upload functionality. This allows unauthorized access to files. The...

CVE-2022-39305 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This...

CVE-2022-42198

In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload...

File Upload Vulnerability in Huatian Power Collaboration Office System

Dalian Huatian Software Co., Ltd. is a high-tech enterprise organized in accordance with the international advanced management mode and system, and is a collaborative management software company known for its leading technology. A file upload vulnerability exists in Huatian Power Collaboration...

PT-2022-26310 · Unknown · Simple Exam Reviewer Management System

Name of the Vulnerable Software and Affected Versions: Simple Exam Reviewer Management System version 1.0 Description: The issue concerns an insecure file upload in the Simple Exam Reviewer Management System. This allows for potential malicious file uploads, which could lead to various security...

CVE-2022-39301 sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload

sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting XSS vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in "Personal Center" ...

CVE-2022-38901

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

PT-2022-24614 · Liferay · Liferay Digital Experience Platform

Name of the Vulnerable Software and Affected Versions: Liferay Digital Experience Platform version 7.3.10 SP3 Description: A Cross-site scripting XSS issue exists in the file upload functionality of the Document and Media module, allowing remote attackers to inject arbitrary JS script or HTML int...

Privilege escalation

An arbitrary file upload vulnerability in the component /phpaction/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

Unrestricted file upload

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the...

CVE-2022-3549

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manageuser of the component Avatar Handler. The manipulation leads to unrestricted upload. The...