CVE-2022-29354: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file...

PT-2022-19559

Name of the Vulnerable Software and Affected Versions Keystone version 4.2.1 Description The issue is related to an arbitrary file upload vulnerability in the file upload module, allowing attackers to execute arbitrary code via a crafted file. Recommendations For Keystone version 4.2.1, update to...

PT-2022-19558

Name of the Vulnerable Software and Affected Versions Graphql-upload version 13.0.0 Description The issue allows attackers to execute arbitrary code via a crafted filename, exploiting an arbitrary file upload vulnerability in the file upload module. Recommendations For Graphql-upload version...

CVE-2022-29351: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here...

Keystone code issues and vulnerabilities

Keystone is a powerful CMS designed to help you build and scale faster than any other Cms or application framework. A security vulnerability exists in Keystone version 4.2.1, which stems from an arbitrary file upload issue in the File Upload module. An attacker can execute arbitrary code via a...

Unrestricted Upload of File with Dangerous Type in Strapi

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file...

GHSA-9QGM-W87Q-HX89 Unrestricted Upload of File with Dangerous Type in Strapi

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file...

Design/Logic Flaw

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

Design/Logic Flaw

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...

Design/Logic Flaw

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-27952

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-27952

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-27263

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

CVE-2022-27952: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-28397: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

PT-2022-18718

Name of the Vulnerable Software and Affected Versions PayloadCMS version 0.15.0 Description The issue allows attackers to execute arbitrary code via a crafted SVG file, exploiting an arbitrary file upload vulnerability in the file upload module. Recommendations For PayloadCMS version 0.15.0,...

PT-2022-18339

Name of the Vulnerable Software and Affected Versions Skipper version 0.9.1 Description The issue is related to an arbitrary file upload vulnerability in the file upload module, allowing attackers to execute arbitrary code via a crafted file. Recommendations For Skipper version 0.9.1, at the...

CVE-2022-27140: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...