Unrestricted file upload

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the...

CVE-2022-41538

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Management-PHP/admin/photosadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41539

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/usersadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-25925 · Unknown · Wedding Planner

Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the /admin/users add.php component. This allows attackers to execute arbitrary code via a crafted PHP file. Recommendations: For Weddin...

Privilege escalation

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

Privilege escalation

Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /phpaction/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41534

CVE-2022-41534 affects Online Diagnostic Lab Management System v1.0. The connected documents confirm an arbitrary file upload vulnerability in the component /php_action/createOrder.php that enables an attacker to execute arbitrary PHP code via a crafted file. This is the core technical detail; no...

PT-2022-25920 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, leveraging an arbitrary file upload vulnerability through the /php action/createOrder.php component...

PT-2022-25919 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, leveraging an arbitrary file upload vulnerability in the /php action/editProductImage.php component...

PT-2022-25846 · Unknown · Church Management System

Name of the Vulnerable Software and Affected Versions: Church Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability in the /admin/admin pic.php component. This allows attackers to execute arbitrary code via a crafted PHP file. The "arbitrary file...

Privilege escalation

An arbitrary file upload vulnerability in the component /leavesystem/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

Privilege escalation

An arbitrary file upload vulnerability in the component /phpaction/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

Backdrop CMS 代码问题漏洞

Backdrop CMS is an open source content management system CMS. A code issue vulnerability exists in Backdrop CMS version 1.22.0, which stems from themes having an unrestricted file upload vulnerability that can be exploited by an attacker to remotely execute code...

CVE-2022-41379

CVE-2022-41379 affects Online Leave Management System v1.0. The vulnerability is an arbitrary file upload in the component path /leave_system/classes/Users.php?f=save, allowing an attacker to execute arbitrary code via a crafted PHP file. The published metrics list a CVSS 3.1 base score of 7.2 (H...

Design/Logic Flaw

DedeCMS 5.7.98 has a file upload vulnerability in the background...

CVE-2022-40886

DedeCMS 5.7.98 has a file upload vulnerability in the background...

php uploader 代码问题漏洞

CreativeDream php uploader is an easy-to-use, high-performance file upload script for CreativeDream personal developers. CreativeDream php uploader version 0.3 is vulnerable to arbitrary file uploads, which stem from a lack of valid validation of uploaded files by the application. An attacker cou...

PT-2022-25354 · Unknown · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal version 2.7 Description: The issue allows attackers to execute arbitrary code via a crafted PNG file, exploiting an arbitrary file upload vulnerability. Recommendations: For mojoPortal version 2.7, consider disabling the file uploa...

CVE-2022-40407

A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file...

CVE-2022-37346

The CVE-2022-37346 issue affects the EC-CUBE plugin “Product Image Bulk Upload Plugin” versions 1.0.0 and 4.1.0, which has an insufficient verification (CWE-20) when uploading files. An unauthenticated remote attacker can upload arbitrary non-image files, and if a user with administrative privile...