FlatCore-CMS 跨站脚本漏洞

flatCore is a PHP and SQLite based Web Content Management System CMS. flatCore version 2.0.7 suffers from a cross-site scripting vulnerability. An attacker can exploit the vulnerability to conduct cross-site scripting attacks via the upload image feature...

Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls

The plugin does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user such as subscriber to call them and 1 Get and search through title and content of Draft post, 2 Get title of a password-protected post as...

XOS Shop 1.0.9 - (Multiple) Arbitrary File Deletion (Authenticated) Vulnerability

Exploit Title: XOS Shop 1.0.9 - 'Multiple' Arbitrary File Deletion Authenticated Exploit Author: faisalfs10x https://github.com/faisalfs10x Vendor Homepage: https://xos-shop.com Software Link: https://github.com/XOS-Shop/xosshopsystem/releases/tag/v1.0.9 Version: 1.0.9 Tested on: Windows 10, XAMP...

Cross-site Scripting (XSS) - Stored in chevereto/chevereto-free

✍️ Description Stored xss via image upload TESTED VESRION latest github code as of 16/7/21 🕵️‍♂️ Proof of Concept 1. First download https://github.com/ranjit-git/poc/blob/master/xss%22'%3E%3Cimg%20src%3Dx%20onerror%3Dalert123%3E.jpeg image file in linux . Dont change the file name . This type file...

ARTWARE CMS Arbitrary File Upload Vulnerability

ARTWARE CMS is an application. A web CMS. ARTWARE CMS suffers from an arbitrary file upload vulnerability, which stems from the fact that the parameters of the ARTWARE CMS image upload feature do not filter the type of files uploaded, and can be exploited by attackers to upload arbitrary files an...

CVE-2021-32538

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...

CVE-2021-32538

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...

Design/Logic Flaw

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...

CVE-2021-32538

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...

CVE-2021-31721

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

CVE-2021-31721

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

Cross site scripting

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

CVE-2021-31721

Chevereto before 3.17.1 is vulnerable to Cross Site Scripting (XSS) via an image title at the image upload stage. This is corroborated across multiple sources (NVD/Red Hat/CVE list and related references). The affected product is Chevereto, and the issue is restricted to versions prior to 3.17.1....

CVE-2021-31721

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

Chevereto 跨站脚本漏洞

Chevereto is a graph bed program. A cross-site scripting vulnerability exists in Chevereto that stems from Chevereto allowing cross-site scripting XSS to be executed via image captions during the image upload phase...

CVE-2021-24349

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lac...

CVE-2021-24349

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lac...

PT-2021-15885 · WordPress · This Gallery From Files

Name of the Vulnerable Software and Affected Versions: This Gallery from files WordPress plugin versions 1.6.0 and earlier Description: The issue arises from the improper sanitization of filenames before being output in an error message when they have an invalid extension, leading to a reflected...

Exploit for Code Injection in Exiftool_Project Exiftool

Gitlab-Exiftool-RCE RCE Exploit for Gitlab 13.10.3 - GitL...

vFairs 代码问题漏洞

vFairs is a virtual event platform by vFairs Singapore. It can host exciting online conferences, trade shows, job fairs and more. A security vulnerability exists in vFairs 3.3, which stems from the fact that any user logged into a vFairs virtual meeting or event can abuse the functionality by...