File Upload Vulnerability in metinfo Mito System

metinfo mito system is an enterprise website management system with PHP Mysql architecture. A file upload vulnerability exists in metinfo Mito System, which can be exploited by attackers to upload arbitrary files...

File Upload Vulnerability in OFCMS Backend

OFCMS is a content management system developed based on java technology. A file upload vulnerability exists in the background of OFCMS, which can be exploited by an attacker to upload arbitrary files...

OFCMS background editUploadImage file upload vulnerability

OFCMS is a content management system based on Java technology. A backend editUploadImage file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files without taking into account file.jsp::$DATA of the...

OFCMS Backend File Upload Vulnerability

OFCMS is a content management system based on Java technology. A background file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files that fails to take into account the file.jsp::$DATA of the admin/comn/service/upload...

CVE-2019-9612

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/comn/service/upload URI...

File Upload Vulnerability in DedeCMS V5.7

DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. DedeCMS V5.7 file upload vulnerability, a...

Booked Scheduler 2.7.5 - Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Booked Scheduler v2.7.5 - Remote Command Execution', 'Description' = %q This module exploits...

Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Booked Scheduler v2.7.5 - Remote Command Execution', 'Description' = %q This module exploits a file upload vulnerability Booked 2.7.5. In the "Loo...

Security feature bypass

DISPUTED An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts...

File Upload Vulnerability in eZiosuite eLearning Platform

eZiosuite online teaching platform is the central system of the whole digital learning, which is a digital learning platform integrating course management, online preparation and production of network courses, course teaching, course resource sharing, and teacher-student interaction. A file uploa...

Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload

=========================================================================================== Exploit Title: Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload Dork: N/A Date: 10-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

CVE-2019-7721 affects nc-cms 3.5. The vulnerability is in lib/NCCms.class.php where uploading a ".php" file is possible via the index.php?action=save name and editordata parameters. The connected Red Hat/NVD entries corroborate the file upload issue and the associated impact (integrity concerns)....

CVE-2019-6289

uploads/include/dialog/selectsoft.php in DedeCMS V57UTF8SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename...

NIUSHOP B2C Single Merchant V2.2 suffers from file upload, information leakage vulnerabilities

NIUSHOP B2C single merchant mall system is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. NIUSHOP B2C Single Merchant V2.2 has a file upload and information leakage vulnerability. The vulnerability stems from the lack...

CVE-2018-20166

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed...

CVE-2018-20166

CVE-2018-20166 — Rukovoditel 2.3.1 file-upload PM/CRM vulnerability Affects: Rukovoditel Project Management CRM version 2.3.1. The flaw is in index.php?module=configuration/save, where extension checks are mishandled and a PHP payload can be uploaded as a background image (e.g., PHP content with ...

IIoT Monitor Dangerous Type File Upload Vulnerability

Schneider Electric IIoT Monitor is an industrial IoT monitor from Schneider Electric France. A security vulnerability exists in Schneider Electric IIoT Monitor version 3.1.38. The vulnerability can be exploited by an attacker to upload and execute malicious files...

CVE-2018-19789

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method e.g. setNamestring $name of a class that's the dataclass of a form, and when a...

HuCart has a file upload vulnerability

HuCart is a PHP+Mysql based enterprise building system CMS that can run on various server platforms such as Linux and Windows. HuCart has a file upload vulnerability that can be exploited by attackers to upload arbitrary files...