Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the file upload functionality. An attacker can execute arbitrary code by uploading a file with a crafted extension and then accessing it through unspecified vectors. Remediation Upgrade in2code/powermail to...

GHSA-49MJ-77Q5-QW5G Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

Stored Cross-site scripting XSS vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality...

GXCMS15 代码问题漏洞

GXCMS15 is a CMS by breezety personal developer. A security vulnerability exists in GXCMS15 version 1.5, which stems from a file upload vulnerability...

novel-plus file upload vulnerability

novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. Novel-plus has a file upload vulnerability, which originates from the lack of file upload restrictions in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java. An...

CVE-2022-29353

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

CVE-2022-29623

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

Gogs Directory Traversal

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

CVE-2022-30448

Hospital Management System in PHP with Source Code HMS 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php...

CVE-2022-30448

Hospital Management System in PHP with Source Code HMS 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php...

Unrestricted file upload

Hospital Management System in PHP with Source Code HMS 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php...

CVE-2022-30448

The CVE-2022-30448 entry relates to the Hospital Management System (HMS) 1.0, a PHP-based app. A concrete vulnerability exists in treatmentrecord.php where file uploads are inadequately validated, enabling an attacker to upload a malicious file. The core issue is lack of proper validation for upl...

Design/Logic Flaw

An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-29318

CVE-2022-29318 affects SourceCodester Car Rental Management System v1.0, specifically the New Entry module. The root cause is lack of validation for uploaded files, enabling arbitrary PHP file uploads and potential code execution. Exploitation details, impacted versions beyond v1.0, and concrete ...

CVE-2021-35532

A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product...

CVE-2022-28120

Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server...

CVE-2022-28120

Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server...

CVE-2022-28120

The CVE-2022-28120 entry concerns Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0. A vulnerability in the file upload feature allows an attacker to gain control of the server. The root cause is described in connected sources...

YetiForceCrm 代码问题漏洞

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A security vulnerability exists in YetiForceCrm versions prior to 6.4.0, which stems from a problematic unreconstructed file upload in the application. An attacker could send a malicious file to the victim and use the...

CVE-2022-29001

The CVE-2022-29001 entry affects SpringBootMovie

CVE-2022-20743 Cisco Firepower Management Center File Upload Security Bypass Vulnerability

A vulnerability in the web management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to t...