5546 matches found
kvf-admin cross-site scripting vulnerability
kvf-admin is a rapid development framework, scaffolding, backend management system, permission system. kvf-admin cross-site scripting vulnerability , the vulnerability stems from the file / ueditor/upload?configPath=ueditor/config.json&action=uploadfile parameter upfile lack of effective filterin...
Student Enrollment 1.0 Arbitrary File Upload
============================================================================================================================================= | Title : Student Enrollment v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...
YPay 安全漏洞
YPay is an aggregated signature-free payment system for individual webmasters by kacins personal developer. A security vulnerability exists in YPay version 1.2.0, which stems from an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code via a ZIP archive in...
CVE-2024-46441
An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php called from app/admin/controller/ypay/Home.php. The file extension of an uncompressed file is not checked...
CVE-2024-8126 Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'classfmaconnector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an...
EUVD-2024-48637
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...
File Upload Vulnerability in Sailsoft Reports by Sailsoft Software Ltd.
Fansoft Reporting is a pure Java written , data display report and data entry form functions in one enterprise-class web reporting tools . A file upload vulnerability exists in FanSoft Reports, which can be exploited by attackers to gain server privileges...
CVE-2023-26690
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu...
WordPress OneElements – Best Elementor Addons plugin <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability
Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin OneElements – Best Elementor Addons versions = 1.3.7...
Exploit for Unrestricted Upload of File with Dangerous Type in Mayurik Best_House_Rental_Management_System
CVE-2024-46377 PoC for Arbitrary File Upload Vulnerability...
Exploit for Path Traversal in Tuzitio Camaleon_Cms
CVE-2024-46986 Camaleon CMS Exploit - Arbitrary File Upload...
PT-2024-31909 · Unknown · Gdidees Cms
Name of the Vulnerable Software and Affected Versions: GDidees CMS versions 3.9.1 and earlier Description: A file upload vulnerability exists in the software. This issue allows for malicious file uploads, potentially leading to security breaches. Recommendations: For versions 3.9.1 and earlier,...
CVE-2024-46373
Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend...
CVE-2024-45398 Remote command execution through file upload in contao/core-bundle
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does...
PT-2024-9684
Name of the Vulnerable Software and Affected Versions Backup and Staging by WP Time Capsule plugin for WordPress versions up to, and including, 1.22.21 Description The issue is related to arbitrary file uploads due to missing file type validation in the UploadHandler.php file and no direct file...
File Upload Vulnerability in Founder Mobile Editorial of Beijing Beifang Founder Electronics Co.
Beijing Founder Electronics Co., Ltd. is a leading provider of technology, products and services in the field of cross-media information communication. A file upload vulnerability exists in Founder Mobile Editorial of Beijing Founder Electronics Co., Ltd, which can be exploited by attackers to...
Risky Deserialization Calls - benryanconversion ( Office Connector Plugin)
The benryanconversion plugin contains a code path that eventually ends up with a partially user-controlled filename being treated as the input for a call to readObject see FileBackedCache.loadFile. To trigger this, an attacker would need to call the following, with a payload in the sheetName...
PT-2024-31278 · Qualitor · Qualitor
Name of the Vulnerable Software and Affected Versions: Qualitor versions up to 8.24 Description: The issue concerns Remote Code Execution RCE via Arbitrary File Upload in the checkAcesso.php file. This allows for the execution of remote code, potentially leading to unauthorized access and control...
IBM webMethods Integration File Upload Vulnerability
IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. A file upload vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an authenticated attacker to upload and execute arbitrary files that can be executed on the...
