CVE-2023-37135

A stored cross-site scripting XSS vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-37135

A stored cross-site scripting XSS vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-37135

A stored cross-site scripting XSS vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-37135

A stored cross-site scripting XSS vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2023-25797 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.3 Description: A stored cross-site scripting issue in the Image Upload module allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For eyoucms version 1.6.3, consider disabling...

CVE-2023-37135

CVE-2023-37135 is a stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3. A crafted payload can cause arbitrary web scripts/HTML to execute in a user context. Affected component: Image Upload in eyoucms 1.6.3. Root cause: stored XSS (no deeper technical det...

CVE-2023-37135

A stored cross-site scripting XSS vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

EyouCms 跨站脚本漏洞

Zanzan Network Technology EyouCms Eyou CMS is an open source content management system CMS based on ThinkPHP by China Zanzan Network Technology. A security vulnerability exists in EyouCms v1.6.3, which stems from a stored cross-site scripting XSS vulnerability in the Image Upload module...

Vulnerable CKEditor used on version 4.2.9

Description When attaching image on mail feature, the upload using ckeditor vulnerable version that lead to RCE. Proof of Concept 1. Go to messages, 2. Write email 3. add image 4. Upload the php file. 5. access the uploaded php file in /admmyfiles/mail/images/ // PoC.js Content-Disposition:...

Remote code execution

Bludit 3.9.2 is vulnerable to Remote Code Execution RCE via /admin/ajax/upload-images...

CVE-2020-20210

Bludit 3.9.2 is vulnerable to Remote Code Execution RCE via /admin/ajax/upload-images...

CVE-2023-2359 Revolution Slider <= 6.6.12 - Author+ Remote Code Execution

The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations...

CVE-2023-3232

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/appauth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used...

CVE-2023-3232 Zhong Bang CRMEB Image Upload app_auth deserialization

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/appauth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used...

CVE-2023-3232 Zhong Bang CRMEB Image Upload app_auth deserialization

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/appauth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used...

CVE-2023-3232

The CVE-2023-3232 entry concerns Zhong Bang CRMEB up to version 4.6.0, where the Image Upload component exposes a deserialization vulnerability in /api/wechat/app_auth caused by some unknown processing of input data. This is classified as critical with a CVSS base score of 9.8 (network vector, us...

PT-2023-23727 · Zhong Bang · Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB versions up to 4.6.0 Description: A critical issue affects the Image Upload component, specifically the file /api/wechat/app auth, leading to deserialization due to some unknown processing. Recommendations: For versions up to...

CVE-2023-3187

A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to...

CVE-2023-1169

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'fileuploadercallback' function in versions up to, and including, 2.1.4. This makes it possible for subscriber-level attackers to upload image attachments to the...