Kiddoware Kids Place Parental Control Android App 3.8.49 XSS / CSRF / File Upload Vulnerabilities

======================================================================= title: Multiple Vulnerabilities product: Kiddoware Kids Place Parental Control Android App vulnerable version: =3.8.49 fixed version: 3.8.50 or higher CVE number: CVE-2023-28153, CVE-2023-29078, CVE-2023-29079 impact: High...

PT-2023-3045 · Advantech · Advantech Webaccess/Scada

Name of the Vulnerable Software and Affected Versions: Advantech WebAccss/SCADA versions 9.1.3 and prior Description: The issue is related to an arbitrary file upload vulnerability. This could allow an attacker to upload an ASP script file to a webserver when logged in as a manager user, leading ...

Remote code execution

Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save...

Kiddoware Kids Place Parental Control Android App 3.8.49 XSS / CSRF / File Upload

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Kiddoware Kids Place Parental Control Android App vulnerable version: =3.8.49 fixed version: 3.8.50 or higher CVE number: CVE-2023-28153...

CVE-2023-30247

File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the updatesettings parameter...

CVE-2023-30247

File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the updatesettings parameter...

CVE-2021-34076

File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload...

PHPOK 代码问题漏洞

PHPOK is an enterprise building system that supports expansion. PHPOK 5.7.140 version of the code problem vulnerability, the vulnerability stems from the existence of a file upload vulnerability, a remote attacker can use this vulnerability through the upload of the produced zip file to run...

CVE-2023-28128

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution...

CVE-2020-22755

MCMS (MingSoft MCMS) is affected by CVE-2020-22755 due to an unrestricted file upload vulnerability in the thumbnail handling, enabling arbitrary code execution. Public references also describe a related issue in MCMS v5.2.8 (CVE-2022-31943) where an arbitrary file upload flaw exists, reinforcing...

CVE-2020-22755

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943...

CVE-2021-28998

File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file...

CVE-2023-30185

CVE-2023-30185 affects CRMEB versions 4.4–4.6 and involves an arbitrary file upload vulnerability via the attachment/SystemAttachmentServices.php component. The issue is documented with a critical CVSS v3.1 score (9.8) affecting confidentiality, integrity, and availability. The connected sources ...

CMS Made Simple 代码问题漏洞

CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple version...

CVE-2023-30122

An arbitrary file upload vulnerability in the component /admin/ajax.php?action=savemenu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2023-29635

CVE-2023-29635 affects Antabot White-Jotter v0.2.2. The issue is a file upload vulnerability where an attacker can supply a crafted file to the coversUpload function, enabling remote code execution. The CVSS 3.1 metrics indicate NETWORK attack vector, NONE privileges required, and high impact to ...

CVE-2023-29635

File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload...

CVE-2023-2419

CVE-2023-2419 affects Zhong Bang CRMEB 4.6.0, where the vulnerability is in the videoUpload function of SystemAttachmentServices.php. The root cause is manipulation of the filename argument that enables unrestricted file uploads. The issue can be triggered remotely and the exploit has been public...

CVE-2023-24269

Textpattern CMS v4.8.8 is affected by an arbitrary file upload vulnerability in the plugin upload function that enables remote code execution via a crafted Zip file. Root cause: insufficient validation of uploaded archives in the plugin upload workflow. CVE-2023-24269 is associated with this issu...

CVE-2023-28819

Concrete CMS (formerly concrete5) has a stored XSS vulnerability in uploaded file and folder names affecting versions 8.5.12 and older, and 9.0.0–9.0.2. Public advisories indicate fixes exist in 9.1+; earlier versions are vulnerable and may expose users to script execution via name fields. No exp...