5509 matches found
CVE-2022-37346
The CVE-2022-37346 issue affects the EC-CUBE plugin “Product Image Bulk Upload Plugin” versions 1.0.0 and 4.1.0, which has an insufficient verification (CWE-20) when uploading files. An unauthenticated remote attacker can upload arbitrary non-image files, and if a user with administrative privile...
CVE-2022-40925
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveevent" file of the "Events" module in the background management system...
CVE-2022-40924
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...
WordPress plugin CM Download Manager 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Arbitrary file upload...
CVE-2022-41352
An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...
CVE-2022-40932
In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gallery" module in the background management system...
Privilege escalation
Authenticated admin+ Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin = 2.6 at WordPress...
CVE-2022-40217 WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability
Authenticated admin+ Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin = 2.6 at WordPress...
Unrestricted file upload
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files...
CVE-2022-32167 Cloudreve - Stored XSS
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting XSS, via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation...
CVE-2022-38323
Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /RoyalEvent/updateimage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
PT-2022-24367 · Unknown · Event Management System
Name of the Vulnerable Software and Affected Versions: Event Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the /Royal Event/update image.php component. Recommendations: F...
CVE-2022-36667
Garage Management System 1.0 is vulnerable to the Remote Code Execution RCE due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the attacker can upload PHP Reverse Shell straight away to gain RCE...
PT-2022-22693 · Sap · Sap Netweaver Application Server Abap
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: The issue allows an attacker with basic business user privileges to craft and upload a malicious file, which is then downloaded and viewed by other users,...
Design/Logic Flaw
Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager...
畅捷通T+安全漏洞
Changjitong T+ is an Internet-based enterprise management system from China's Changjitong Company, featuring business management, order tracking, funding, inventory, and other functions. An unauthorized attacker can upload malicious files through the exposed web service interface of Changjitong T...
CVE-2022-36582
An arbitrary file upload vulnerability in the component /phpaction/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-37159
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload...
PT-2022-17611 · WordPress · Advanced Custom Fields Pro
Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields WordPress plugin versions prior to 5.12.3 Advanced Custom Fields Pro WordPress plugin versions prior to 5.12.3 Description: The issue allows unauthenticated users to upload files, limited to those allowed in a default...