CVE-2020-24986

Concrete5 (CMS) up to and including 8.5.2 is vulnerable to an Unrestricted Upload of a dangerous file type (e.g., .php) via the File Manager, enabling execution of arbitrary commands. Affected: Concrete5 8.5.2 and earlier. Root cause: file-type upload not sufficiently restricted. Impact: potentia...

File Upload Vulnerability in Mantis Chinese Enhanced Edition

Mantis is a lightweight open source defect tracking system based on PHP technology to provide project management and defect tracking services in the form of Web operations . A file upload vulnerability exists in the Chinese enhanced version of Mantis. An attacker can exploit the vulnerability to...

Design/Logic Flaw

interface/new/newcomprehensivesave.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve remote code execution RCE on the hosting webserver by uploading a maliciously crafted image...

CVE-2020-23971

The CVE-2020-23971 entry concerns the gmapfp.org Joomla Component GMapFP J3.30pro, with a vulnerability described as Insecure Permissions that lets an attacker access the upload function without authentication and perform unrestricted file uploads. The root cause cited is improper permissions and...

VulnCheck KEV: CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

File Upload Vulnerability in daozicms V1.4

Daozicms Enterprise Building System is a cms enterprise building system developed by Thinkphp6.0.2+layui-v2.3.0+Mysql5.7. A file upload vulnerability exists in daozicms V1.4, which can be exploited by attackers to gain server administrative privileges...

File Upload Vulnerability in Zhengfang Digital Campus Information Unified Authentication Center System

Founded in January 1999 with a registered capital of 50.5 million RMB, Zhengfang Software Co., Ltd hereinafter referred to as "Zhengfang" is a software enterprise and a high-tech enterprise specializing in consulting, planning, construction and service in the field of education informatization in...

File Upload Vulnerability in Mu Feng CMS of Shijiazhuang Jiesou Network Technology Co.

Mu Feng CMS is Shijiazhuang JieSuo network 202 years launched a newest use of think PHP framework of the website backend management system. Shijiazhuang Jiesou Network Technology Co., Ltd. Mu Feng CMS file upload vulnerability, an attacker can use the vulnerability to obtain control of the web...

File Upload Vulnerability in ED01-CMS

ED01-CMS is a content management system. ED01-CMS suffers from a file upload vulnerability that can be exploited by an attacker to gain control of a web server...

Autoptimize < 2.7.7 - Authenticated Arbitrary File Upload

The aoccssimport AJAX call does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. https://drive.google.com/file/d/1siZsDiJsYRCw58Ksram5zBJOVbs-Hio1/view?usp=sharing POST /wp-admin/admin-ajax.php HTTP/1...

File upload vulnerability exists in SIYUCMS of Shenyang Dotcom Technology Co. Ltd (CNVD-2020-56662)

SIYUCMS is based on the latest version of ThinkPHP-5.1.X framework, the backend front-end framework using AdminLTE. the core concept of the system is " do the most suitable for the enterprise CMS ". SIYUCMS of Shenyang Dotcom Technology Co., Ltd. has a file upload vulnerability, which can be...

Dolibarr Elevation of Privilege Vulnerability

Dolibarr ERP/CRM is an open source software/freeware for small and medium-sized businesses, organizations or freelancers. It includes different features such as Enterprise Resource Planning ERP and Customer Relationship Management CRM, as well as applications for other different activities. An...

File Upload Vulnerability in 07FLY-CRM of Sichuan Trust Technology Co.

07FLY-CRM CRM system is developed by Zero Takeoff Network, based on the GPLv3 protocol release, for small and medium-sized enterprise management activities, providing customer relationship management CRM, sales and marketing inventory JXC, human resources HRM and other functions. A file upload...

CVE-2020-22721

A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscellaneous " External Programs by uploading the malicious .exe file to the external program...

Unrestricted file upload

A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscellaneous " External Programs by uploading the malicious .exe file to the external program...

The vulnerability of the File Upload component of the Oracle Enterprise Session Border Controller allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the File Upload component in Oracle Enterprise Session Border Controller is related to errors during resource release. Exploiting this vulnerability can allow an attacker operating remotely to gain access to read, modify, add, or delete data using the HTTP protocol...

File upload vulnerability in version 3.6.0 of the WeCenter Social Q&A Community program

WeCenter is an open source knowledge-based social Q&A community program. A file upload vulnerability exists in version 3.6.0 of the WeCenter social Q&A community program, which can be exploited by an attacker to gain server privileges...

Travel Management System 1.0 Remote Code Execution

Exploit Title: Travel Management System v1.0 - Unauthenticated Remote Code Execution Exploit Author: Adeeb Shah @hyd3sec & Bobby Cooke boku Vulnerability Discovery: Adeeb Shah @hyd3sec Date: August 10, 2020 Vendor Homepage: https://projectworlds.in/ Software Link:...

TPshop open source mall merchant management background Uploadify page file upload vulnerabilities exist

TPshop open source mall is developed with the latest version of ThinkPHP shop mall. TPshop open source mall merchant management background Uploadify page file upload vulnerability. Attackers can use this vulnerability to upload webshell, get server privileges...

File Upload Vulnerability After Destoon B2B Content Management System

DESTOON® B2B Website Management System is an open source B2B e-commerce industry portal solution based on PHP+MySQL. A file upload vulnerability exists after the Destoon B2B content management system, which can be exploited by attackers to gain server administrative privileges...