CVE-2022-29001

The CVE-2022-29001 entry affects SpringBootMovie

CVE-2022-20743 Cisco Firepower Management Center File Upload Security Bypass Vulnerability

A vulnerability in the web management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to t...

WordPress plugin Import WP代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Import WP plugin is vulnerable to a file upload vulnerability, which stems from the plugin'...

CVE-2022-28528

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

Design/Logic Flaw

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

Input validation

Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files...

CVE-2021-4225

The CVE concerns the SP Project & Document Manager WordPress plugin (pre-4.24). The issue arises in the file-upload feature, where authentication is not restricted and users such as subscribers can upload files. The vendor’s extension-based checks are intended to block executable PHP or similar f...

CVE-2021-43742

CMSimple 5.4 is vulnerable to Cross Site Scripting XSS via the file upload feature...

GHSA-W4M6-X6C2-J5C9 Express-FileUpload Arbitrary File Overwrite

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This vulnerability is debated by the package author...

Unrestricted Upload of File with Dangerous Type in Payload

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

GHSA-W8XH-93QH-35VW Unrestricted Upload of File with Dangerous Type in Payload

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

Organizr 代码问题漏洞

Organizr is a tab management system. Designed to be a one-stop store for server front ends, Organizr versions prior to 2.1.1810 have a file upload vulnerability that stems from the lack of valid validation of uploaded files by the application, which can be exploited by attackers to upload .svg...

CVE-2022-27261

CVE-2022-27261 describes an arbitrary file write vulnerability in Express-FileUpload v1.3.1. The issue allows uploading multiple files with the same name, leading to overwriting existing files on the web application server. Connected documents corroborate the affected product/version and impact, ...

zbzcms arbitrary file upload vulnerability

zbzcms station helper CMS is a content management website of China station helper CMS zbzcms company. zbzcms version 1.0 has an arbitrary file upload vulnerability, which can be exploited by attackers to execute arbitrary code via specially crafted PHP files...

PT-2022-19000

Name of the Vulnerable Software and Affected Versions Ghost CMS version 4.42.0 Description An arbitrary file upload vulnerability in the file upload module of Ghost CMS allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published b...

Remote code execution

In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload...

CVE-2022-1008

The CVE-2022-1008 entry concerns the WordPress plugin One Click Demo Import (up to version 3.0.x; fixed in 3.1.0) where imported files are not validated. This enables high-privilege users (e.g., admin) to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed. Multi...

CVE-2022-27129

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2021-46367

RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default...

CVE-2022-27351

The CVE-2022-27351 entry describes an arbitrary file upload vulnerability in Zoo Management System v1.0, exploitable via the /public_html/apply_vacancy endpoint. The underlying issue is lack of file-type restrictions, allowing an attacker to upload a crafted PHP file and achieve arbitrary code ex...