114 matches found
Edu-Sharing Arbitrary File Upload
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Arbitrary File Upload product: edu-sharing metaVentis GmbH vulnerable versions: =8.0.8-RC2, =8.1.4-RC0, =9.0.0-RC19 CVE number: CVE-2024-28147 impact: high homepage:...
PT-2024-13957 · Nocodb · Nocodb
Name of the Vulnerable Software and Affected Versions: NocoDB versions 0.202.6 through 0.202.9 Description: The issue allows an attacker to upload a html file with malicious content. If a user tries to open that file in a browser, malicious scripts can be executed, leading to a stored cross-site...
PT-2024-21047 · Alf.Io · Alf.Io
Name of the Vulnerable Software and Affected Versions: Alf.io versions prior to 2.0-M4-2402 Description: The issue allows an administrator on the Alf.io application to upload HTML files that trigger JavaScript payloads. This could enable an attacker who gains administrative access to persist acce...
Statmic CMS vulnerable to account takeover via XSS and password reset link
Impact HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects: - front-end forms with asset fields without any mime type validation - asset fields in the control panel - asset browser in the control panel Additionally, if the XSS is crafted in a specific...
Cross site scripting
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel...
StrangeBee TheHive Security Vulnerability
TheHive is a scalable open source security incident response platform. A security vulnerability exists in StrangeBee TheHive versions 5.1.0 through 5.1.9 and 5.2.0 through 5.2.8. An attacker can exploit the vulnerability to upload malicious HTML files with Javascript code...
CVE-2023-51252
PublicCMS 4.0 is vulnerable to Cross Site Scripting XSS. Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing...
CVE-2023-1720
Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through...
CVE-2023-45281
An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file...
Yamcs Cross-Site Scripting Vulnerability
Yamcs is an open source software framework from Yamcs Open Source. It is used to command and control spacecraft, satellites, payloads, ground stations and ground equipment. A security vulnerability exists in Yamcs version 5.8.6, which originates from a method that allows you to upload an HTML fil...
Cockpit Cross-site Scripting vulnerability
Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. For any role that has permission to execute function assets, an attacker can upload a html file and that leads to XSS...
Cross-site Scripting (Stored XSS)
Description For any role that has permission to execute function assets, i can add a new asset. Even though the site only allows uploading images and gifs, I can still upload an html file by modifying the magic number and that leads to XSS. Proof of Concept 1. Link PoC:...
CVE-2023-27082
Cross Site Scripting XSS vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of crafted html file...
PT-2023-20940 · Pluck Cms · Pluck Cms
Name of the Vulnerable Software and Affected Versions: Pluck CMS versions 4.7.15 through 4.7.16-dev4 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It affects the /admin.php endpoint, allowing remote attackers to run arbitrary code via the upload of a crafted html...
Pluck 跨站脚本漏洞
Pluck is a content management system CMS developed using the PHP language. A security vulnerability exists in Pluck CMS versions 4.7.15 through 4.7.16-dev4, which originates from a cross-site scripting XSS vulnerability in file /admin.php. An attacker can exploit the vulnerability by uploading a...
CVE-2023-34855
A Cross Site Scripting XSS vulnerability in Youxun Electronic Equipment Shanghai Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /upfile.cgi...
D-Link AC Centralized Management Platform 跨站脚本漏洞
D-Link AC Centralized Management Platform is a centralized management platform from China-based D-Link. A security vulnerability exists in D-Link AC Centralized Management Platform v1.02.040, which originates from a cross-site scripting XSS vulnerability that allows an attacker to execute arbitra...
PT-2023-25036 · Youxun Electronic Equipment (Shanghai) Co. · Ac Centralized Management Platform
Name of the Vulnerable Software and Affected Versions: Youxun Electronic Equipment Shanghai Co., Ltd AC Centralized Management Platform version 1.02.040 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code via uploading a crafted HTML file to the "upfile.cgi" A...