Remote Code Execution (RCE)

ssddanbrown/bookstack is vulnerable to remote code execution RCE. The attack exists because it allows untrusted users to upload PHP files to any area of applications by using image upload function and to execute the malicious PHP code on host system with PHP process permissions...

BookStack Remote Code Execution Vulnerability

BookStack is a platform for storing and organizing information and documents. A remote code execution vulnerability exists in versions of BookStack prior to 0.25.5. The vulnerability stems from a user being able to upload PHP files via the image upload feature. An attacker can exploit this...

CVE-2020-5256

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users...

CVE-2020-5256

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users...

Information disclosure

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users...

JetBrains Security Bulletin Q4 2019

FYI Security JetBrains Security Bulletin Q4 2019 Robert Demmer In the fourth quarter of 2019, we resolved a series of security issues in our products. Here’s a summary report that contains a description of each issue and the version in which it was resolved. Product | Description | Severity |...

CVE-2020-5509

PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...

Remote code execution

PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...

CVE-2020-5509

CVE-2020-5509 affects PHPGurukul Car Rental Project v1.0. It allows Remote Code Execution via an executable file uploaded as a new profile image, due to improper validation of uploaded files. Exploit details are described in Exploit-DB and PacketStorm reports, and PT-2020-18486 recommends restric...

DEBIAN-CVE-2020-1766

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...

CVE-2020-1766

CVE-2020-1766 affects OTRS/Open Source Ticket Request System where improper handling of uploaded images can, in very rare conditions, cause a browser to execute malicious JavaScript from a crafted SVG rendered as an inline JPG. Public advisories in connected documents refer to multiple vendor upd...

Unspecified vulnerability in upload-image-with-ajax

upload-image-with-ajax is an image file upload tool. A security vulnerability exists in upload-image-with-ajax v1.0, which is caused by a logic error in the code. The vulnerability can be exploited to upload arbitrary files to the web root directory and execute code...

Verot 2.0.3 Remote Code Execution

Exploit Title: Verot 2.0.3 - Remote Code Execution Date: 2019-12-05 Exploit Author: Jinny Ramsmark Vendor Homepage: https://www.verot.net/phpclassupload.htm Software Link: https://github.com/verot/class.upload.php Version: '; $quality = "85"; $baseurl = "http://lorempixel.com"; echo "-=Imagejpeg...

Verot 2.0.3 - Remote Code Execution

Exploit Title: Verot 2.0.3 - Remote Code Execution Date: 2019-12-05 Exploit Author: Jinny Ramsmark Vendor Homepage: https://www.verot.net/phpclassupload.htm Software Link: https://github.com/verot/class.upload.php Version: '; $quality = "85"; $baseurl = "http://lorempixel.com"; echo "-=Imagejpeg...

Bludit - Directory Traversal Image File Upload (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' = %q This module exploits a vulnerability in Bludit. A remote user cou...

WordPress Social Photo Gallery 1.0 Remote Code Execution Vulnerability

Exploit for php platform in category web applications ============================================= - Discovered by: Prestigia Seguridad - Severity: 7,5/10 CVSS Base Score - CVE-ID: CVE-2019-14467 ============================================= I. VULNERABILITY ------------------------- WordPress...

Scripteen Image Upload Shell Upload

Exploit Title : Scripteen İmage Upload Script Arbitrary File Injection + Venedor Home Page : https://scripteen.com/ + Author : z3r0fy + Twitter : z3r0fy + Website : www.bugcontainer.gq + CX Security Link : https://cxsecurity.com/issue/WLB-2019100145 + Description : Due to these codes in the...

CVE-2019-17629

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

CVE-2019-17188

An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...

Arbitrary File Upload Vulnerability in Guojiz

Guojiz is a light community system based on layui front-end framework and thinkphp. Guojiz has an arbitrary file upload vulnerability, which can be exploited by an attacker to upload any type of image, such as a php Trojan horse, when editing a forum post or adding a comment via the upload image...