5509 matches found
PT-2023-13349 · WordPress · Wptouch
Name of the Vulnerable Software and Affected Versions: WPtouch WordPress plugin versions prior to 4.3.45 Description: The issue allows high privilege users, such as admins, to upload arbitrary files on the server, even when they should not be allowed to, for example in a multisite setup. This is...
Unrestricted File Upload
microweber/microweber is vulnerable to unrestricted file upload. The sanitization filter bypass in plupload.php allows a remote authenticated attacker to upload files outside the intended locations...
Easytest 代码问题漏洞
Easytest is an online learning quiz platform of China Huaqi Digital Technology Company. A security vulnerability exists in Easytest due to an insufficient filtering of special characters and file types in its File Upload feature, which allows remote attackers with normal user privileges to upload...
PT-2022-27789 · Unknown · Metersphere
Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 2.5.1 Description: The issue allows users to upload a file without validating the file name, potentially leading to uploading files to any path if the file name in the upload request is falsified. This is due to ...
CVE-2022-4732 Unrestricted Upload of File with Dangerous Type in microweber/microweber
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2...
CVE-2022-4665 Unrestricted Upload of File with Dangerous Type in ampache/ampache
Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6...
CVE-2022-46493
CVE-2022-46493 affects the nbnbk default version, with an arbitrary file upload vulnerability exposed via the /api/User/download_img endpoint. The CVE is rated CVSS v3.1 base score 9.8 (CRITICAL), with network attack vector, no privileges required, and no user interaction; impacts to confidential...
CVE-2022-4061 JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload
The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP...
PT-2022-25418 · WordPress · Jobboardwp
Name of the Vulnerable Software and Affected Versions: JobBoardWP WordPress plugin versions prior to 1.2.2 Description: The issue allows unauthenticated users to upload arbitrary files, such as PHP, due to improper validation of file names and types in the file upload functionalities...
CVE-2022-46135
CVE-2022-46135 affects AeroCms v0.0.1. The vulnerability is an arbitrary file upload at /admin/posts.php?source=edit_post that enables uploading a webshell and taking control of the web server. Affected component is the upload endpoint in the admin/post editing flow; root cause details are consis...
Unrestricted file upload
File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php...
CVE-2022-4506 Unrestricted Upload of File with Dangerous Type in openemr/openemr
Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...
CVE-2020-20588
File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php...
PT-2022-8621 · Unknown · Zhimengzhe Ibarn
Name of the Vulnerable Software and Affected Versions: zhimengzhe iBarn version 1.5 Description: The issue allows remote attackers to run arbitrary code via avatar upload to "index.php". This is due to a file upload vulnerability in the upload function in action/Core.class.php. Recommendations: F...
CVE-2021-36573
File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload...
CVE-2021-36573
File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload...
Design/Logic Flaw
The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...
SENS 代码问题漏洞
SENS is an enterprise blog system by saysky individual developer. A code issue vulnerability exists in SENS v1.0, which stems from the presence of a file upload vulnerability...
PT-2022-6295 · Unknown · Apex-Vuz Automation System
Name of the Vulnerable Software and Affected Versions: Apex-VUZ automation system affected versions not specified Description: The issue is related to the messaging component of the custom file upload module in the Apex-VUZ automation system. It involves the unrestricted upload of dangerous file...