CVE-2022-46135

CVE-2022-46135 affects AeroCms v0.0.1. The vulnerability is an arbitrary file upload at /admin/posts.php?source=edit_post that enables uploading a webshell and taking control of the web server. Affected component is the upload endpoint in the admin/post editing flow; root cause details are consis...

Unrestricted file upload

File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php...

PT-2022-8621 · Unknown · Zhimengzhe Ibarn

Name of the Vulnerable Software and Affected Versions: zhimengzhe iBarn version 1.5 Description: The issue allows remote attackers to run arbitrary code via avatar upload to "index.php". This is due to a file upload vulnerability in the upload function in action/Core.class.php. Recommendations: F...

CVE-2021-36573

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload...

CVE-2020-20588

File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php...

CVE-2022-4506 Unrestricted Upload of File with Dangerous Type in openemr/openemr

Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2021-36573

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload...

Design/Logic Flaw

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

PT-2022-6295 · Unknown · Apex-Vuz Automation System

Name of the Vulnerable Software and Affected Versions: Apex-VUZ automation system affected versions not specified Description: The issue is related to the messaging component of the custom file upload module in the Apex-VUZ automation system. It involves the unrestricted upload of dangerous file...

PT-2022-25014 · WordPress · Appointment Booking System

Name of the Vulnerable Software and Affected Versions: Appointment Booking System WordPress plugin versions prior to 3.2.2 Description: The issue allows unauthenticated users to upload arbitrary files, such as PHP, which could achieve Remote Code Execution RCE due to a lack of validation for...

CVE-2022-45759

SENS v1.0 has a file upload vulnerability...

SENS 代码问题漏洞

SENS is an enterprise blog system by saysky individual developer. A code issue vulnerability exists in SENS v1.0, which stems from the presence of a file upload vulnerability...

CVE-2022-45968

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder even a password protected one...

CVE-2022-42458

Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered...

CVE-2022-44289

Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell...

CVE-2022-36431

Summary (validated): CVE-2022-36431 affects Rocket TRUfusion Enterprise prior to 7.9.6.1. An unauthenticated attacker can upload a crafted JSP file to achieve arbitrary code execution due to an arbitrary file upload vulnerability. The issue is fixed in version 7.9.6.1. Affected software: Rocket T...

Contec SolarView Compact 代码问题漏洞

Contec SolarView Compact is an application system from Contec Japan. It provides photovoltaic power generation measurement system. A file upload vulnerability exists in Contec SolarView Compact versions 4.0 and 5.0. The vulnerability stems from the application's lack of effective validation of...

CVE-2022-44400

Purchase Order Management System v1.0 contains a file upload vulnerability via /purchaseorder/admin/?page=systeminfo...

CVE-2022-44400

Purchase Order Management System v1.0 contains a file upload vulnerability via /purchaseorder/admin/?page=systeminfo...

CVE-2022-44400

CVE-2022-44400 affects Purchase Order Management System v1.0. The vulnerability is an unrestricted file upload exposed at /purchase_order/admin/?page=system_info, described as a file upload vulnerability. CVSS v3.1 metrics indicate a CRITICAL impact (C/H, I/H, A/H) with NETWORK attack vector, LOW...