5530 matches found
CVE-2021-23562
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
Design/Logic Flaw
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
Business-Dna Solution GmbH TopEase File Upload Vulnerability
Business-Dna Solution GmbH TopEase is a "Transformational Risk" solution from Business-Dna Solution GmbH, Switzerland. It is used to manage complex projects and initiatives comprehensively, simply, quickly and securely. A file upload vulnerability exists in Business-Dna Solution GmbH TopEase, whi...
Remote code execution
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...
CVE-2021-22968
Summary of CVE-2021-22968 (Concrete CMS / concrete5): A bypass in the File Manager’s external file upload allows remote code execution in Concrete CMS versions 8.5.6 and earlier. The feature stages uploaded files in the public directory even when their extensions are disallowed, storing them in a...
Unrestricted access to predictable file paths in hov/jobfair
An issue was discovered in the jobfair aka Job Fair extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded...
Unrestricted file upload
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type...
CVE-2021-42669
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...
VulnCheck KEV: CVE-2018-15961
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution...
CVE-2021-20707
Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to rea...
CVE-2018-25019
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...
CVE-2018-25019
CVE-2018-25019 affects the LearnDash LMS WordPress plugin (versions before 2.5.4). The root cause is lack of authorization/validation for uploaded files in learndash_assignment_process_init(), enabling unauthenticated users to upload arbitrary files to the web server. Impact is arbitrary file upl...
File Upload Vulnerability in Heartland OA 2021 Autumn Solid Edition (CNVD-2021-89119)
Mindtone OA is an oa office tool equipped with AI artificial intelligence. A file upload vulnerability exists in Heartland OA 2021 Autumn Edition, which can be exploited by attackers to gain control of the server...
File Upload Vulnerability in Heartland OA 2021 Autumn Edition
Mindtone OA is an oa office tool equipped with AI artificial intelligence. A file upload vulnerability exists in Heartland OA 2021 Autumn Edition, which can be exploited by attackers to gain control of the server...
File upload vulnerability exists in Heartland OA 2021 Autumn Solid Edition (CNVD-2021-89120)
Mindtone OA is an oa office tool equipped with AI artificial intelligence. A file upload vulnerability exists in Heartland OA 2021 Autumn Edition, which can be exploited by attackers to gain control of the server...
Sourcecodester Customer Relationship Management System File Upload Vulnerability
Sourcecodester Customer Relationship Management System is an open source Php project by the individual developer Carlo Montero. Used to provide an online platform for companies to manage interactions with their customers or prospects. A file upload vulnerability exists in Sourcecodester Customer...
in bookstackapp/bookstack
Description During reading recent BookStack source code 31665410 I discovered no uploaded file type and size check. Authenticated user with attachment create role can upload any type file. One of possibilities is to upload phishing page and get administrators credentials. Proof of Concept POST...
Heartland OA 2021 Autumn Real Edition has a file upload vulnerability (CNVD-2021-88620)
HeartTone OA is a versatile and intelligent office application. Heart to Heart OA 2021 Autumn Real Edition has a file upload vulnerability, which can be exploited by attackers to gain control of the server...
CVE-2021-37221
CVE-2021-37221 affects Sourcecodester Customer Relationship Management System 1.0. A file-upload flaw in the account update and customer-create paths could let a remote attacker upload an arbitrary PHP file, enabling code execution on the server. Public references include an exploit in Exploit-DB...
