File Upload Vulnerability in anmi V1.1.0

Anmi program is a program that focuses on H5 mobile website/app construction. A file upload vulnerability exists in anmi V1.1.0. An attacker can exploit this vulnerability to upload arbitrary files...

Upload Vulnerability in Guoneng Rixin Power Station O&M Management System

National Energy Rising Technology Co., Ltd. is a high-tech enterprise specializing in providing new energy software products and services. A file upload vulnerability exists in the Power Plant Operation and Maintenance Management System of Guoneng Rising Technology Co. An attacker can exploit thi...

File upload vulnerability in emlog v6.0.0 backend pl***.php page

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. A file upload vulnerability exists in the emlog v6.0.0 backend pl.php page. An attacker can exploit the vulnerability to elevate background privileges...

CVE-2018-15537

Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...

Baidu WebUploader component suffers from file upload vulnerability

WebUploader is a simple HTML5-based, FLASH-supported modern file upload component developed by the Baidu WebFE FEX team. A file upload vulnerability exists in the Baidu WebUploader component. The vulnerability is due to the WebUploader component upload page to the file type or file extension...

File Upload Vulnerability in EnterCRM Backend

Hangzhou Ensoft Information Technology Co., Ltd. is a comprehensive company specializing in foreign trade customer resource management and order management products and services. An upload vulnerability exists in the EnterCRM backend. Allows attackers to upload webshell and gain server privileges...

2-Plan Team 1.0.4 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: 2-Plan Team 1.0.4 - Arbitrary File Upload Exploit Author: Ihsan Sencan Vendor Homepage: http://2-plan.com/ Software Link: https://datapacket.dl.sourceforge.net/project/to-plan-team/1.1.0/2-plan-team.tgz Version: 1.0.4 Category:...

2-Plan Team 1.0.4 - Arbitrary File Upload

Exploit Title: 2-Plan Team 1.0.4 - Arbitrary File Upload Dork: N/A Date: 2018-11-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://2-plan.com/ Software Link: https://datapacket.dl.sourceforge.net/project/to-plan-team/1.1.0/2-plan-team.tgz Version: 1.0.4 Category: Webapps Tested on:...

Cisco Prime Infrastructure Unauthenticated Remote Code Execution Exploit

Cisco Prime Infrastructure CPI contains two basic flaws that when exploited allow an unauthenticated attacker to achieve remote code execution. The first flaw is a file upload vulnerability that allows the attacker to upload and execute files as the Apache Tomcat user; the second is a privilege...

Cisco Prime Infrastructure Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco Prime Infrastructure Unauthenticated Remote Code Execution', 'Description' = %q Cisco Prime Infrastructure CPI contains two basic flaws tha...

File upload vulnerability in the free version of TouchNet Universal Mall system

TouchNet universal mall station-building system is a set of universal station-building system developed by Tianjin TouchNet Technology Co. TouchNet Universal Mall Station Building System free version of the foreground there is a file upload vulnerability, an attacker can use the vulnerability to...

CVE-2018-19114

An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindocid value containing the relative pathname of this uploaded file. For example, the...

Design/Logic Flaw

IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code on the system, caused by a missing restriction in which file types can be uploaded to the control room. By uploading a malicious file and tricking a victim to run it, an attack...

CVE-2018-1552

IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code on the system, caused by a missing restriction in which file types can be uploaded to the control room. By uploading a malicious file and tricking a victim to run it, an attack...

Expense Management 1.0 Shell Upload

Exploit Title: Expense Management 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-10-30 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.webprojectbuilder.com/item/expense-management Software Link:...

CI User Login and Management 1.0 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: CI User Login and Management 1.0 - Arbitrary File Upload Exploit Author: Ihsan Sencan Vendor Homepage 1: http://www.webprojectbuilder.com/item/user-login-and-management Vendor Homepage 2:...

DocCms 2016 version has a file upload vulnerability at the backend templates

DocCMS rice husk enterprise building system, also known as rice husk cms, doccms, formerly known as deep throat enterprise building system ShlCms, is the industry's leading free open source enterprise website building system, enterprise website generation system. DocCms 2016 version of the file...

Unspecified Vulnerability in Oracle Application Object Library (CNVD-2018-24260)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. Application Object Library AOL, Application Object Library is one of the system management components. A security vulnerability exists in the...

Advanced HRM 1.6 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications Exploit Title: Advanced HRM 1.6 - Remote Code Execution Google Dork: intext:"Advanced HRM" Exploit Author: Renos Nikolaou Vendor Homepage: https://coderpixel.com/ Software Link: https://codecanyon.net/item/advanced-hrm/17767006 Version: 1.6...

Cisco Prime Infrastructure TFTP file upload vulnerability

Added: 10/11/2018 BID: 105506 Background Cisco Prime Infrastructure, is a management system of wireless and wired networks. Problem A vulnerability in Cisco Prime Infrastructure allows remote, unauthenticated attackers to execute arbitrary commands by uploading a JSP file via TFTP, and then...