Online Traffic Offense Management System 1.0 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: Online Traffic Offense Management System 1.0 - Remote Code Execution RCE Unauthenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.sourcecodester.com Software Link:...

Online Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)

Exploit Title: Online Traffic Offense Management System 1.0 - Remote Code Execution RCE Unauthenticated Date: 20-08-2021 Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.sourcecodester.com Software Link:...

CVE-2021-37711

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

CVE-2021-37711

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

Simple eCommerce <= 2.2.5 - Arbitrary File Upload

The plugin does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE...

Email Artillery <= 4.1 - Arbitrary File Upload

The plugin does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denyin...

Exploit for Unrestricted Upload of File with Dangerous Type in Webnus Modern_Events_Calendar_Lite

CVE-2021-24145 WordPress File Upload Vulnerability, Modern Eve...

CVE-2021-24499

The Workreap WordPress theme before 2.2.2 AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp...

SourceCodester Phone Shop Sales Management System File Upload Vulnerability

SourceCodester Phone Shop Sales Management System is a PHP project called Phone Shop Sales Management System by SourceCodester USA. The project manages phone store sales transactions. A file upload vulnerability exists in SourceCodester Phone Shop Sales Management System, which can be exploited b...

File Upload Vulnerability in NetSign Signature Verification Server of Dongfang Tongweb Middleware of Beijing Xin'an Century Technology Co.

Ltd. provides signature verification server NetSign to provide digital signature services based on digital certificates for various types of electronic information data, electronic documents, etc., and verify the authenticity and validity of signatures on signed data; support user certificate...

CVE-2021-32594

An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-privileged user to potentially tamper with the underlying system's files via the upload of specifically crafted files...

CVE-2020-19303

CVE-2020-19303 affects hdcms 5.7, where the vulnerability resides in the /fileupload.php endpoint. An attacker can upload a crafted file, triggering arbitrary code execution on the server. The CVE is documented across multiple sources (NVD, Red Hat, CVE listings, and related advisories) with expl...

SourceCodester Learning Management System File Upload Vulnerability

SourceCodester Learning Management System is an online learning management system from SourceCodester, Inc. in the United States. A file upload vulnerability exists in SourceCodester Learning Management System, which can be exploited by an attacker to execute arbitrary code...

CVE-2021-25200

Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\studentavatar.php...

SourceCodester Learning Management System 代码问题漏洞

SourceCodester Learning Management System is an online learning management system from SourceCodester, Inc. in the United States. A file upload vulnerability exists in SourceCodester Learning Management System, which can be exploited by an attacker to execute arbitrary code...

CVE-2021-36741

CVE-2021-36741 affects Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1. The root cause is an improper input validation that enables a remote attacker, who must have access to log in to the product management console, to upload arbitrary files ...

CVE-2021-36741

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the...

CVE-2021-25210

The CVE-2021-25210 entry concerns SourceCodester Alumni Management System v1.0. Affected software: SourceCodester Alumni Management System; vulnerable component: the file upload pathway (manage_event.php). Root cause: arbitrary file upload allows an attacker to upload and execute arbitrary code o...

CVE-2021-36121

An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeedMnt/FileUploadUpd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files...

CVE-2021-36121

An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeedMnt/FileUploadUpd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files...