CVE-2024-7192

A vulnerability, which was classified as critical, was found in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/student.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit...

Arbitrary File Upload

Automad is vulnerable to Arbitrary File Upload. The vulnerability is due to improper file type checks within the image upload function, allowing attackers to execute arbitrary code via a crafted file...

GHSA-47MC-QMH2-MQJ4 Automad arbitrary file upload vulnerability

An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. The malicious file has to be prepared and uploaded manually by the admin. Usually there is only one admin per site and that is the owner...

CVE-2024-40400

An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2024-40400

An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file...

PT-2024-28828 · Automad · Automad

Name of the Vulnerable Software and Affected Versions: Automad version 2.0.0 Description: An arbitrary file upload vulnerability in the image upload function allows attackers to execute arbitrary code via a crafted file. The malicious file has to be prepared and uploaded manually by the admin,...

CVE-2024-6801

A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects some unknown processing of the file /add-students.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated...

WordPress plugin Quotes and Tips by BestWebSoft Security Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability previously existed in the...

PT-2024-23788 · Bestwebsoft · The Quotes/Tips By Bestwebsoft Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Quotes and Tips by BestWebSoft WordPress plugin versions prior to 1.45 Description: The issue concerns the improper validation of image files uploaded by high privilege users, such as admins, allowing them to upload arbitrary files on the...

WordPress Featured Image Generator plugin <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Images Upload vulnerability discovered by Lucio Sá in WordPress Plugin Featured Image Generator versions = 1.3.1...

CVE-2024-5677

The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the figsaveaftergenerateimage function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access an...

CVE-2024-5677

CVE-2024-5677 affects the Featured Image Generator plugin for WordPress. Root cause: missing capability check in fig_save_after_generate_image on all versions up to and including 1.3.1. Impact: allows authenticated attackers with Subscriber-level access and above to upload arbitrary images to a p...

CVE-2024-5677 Featured Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload

The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the figsaveaftergenerateimage function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access an...

OpenStack: malicious qcow2/vmdk images

An input validation flaw was discovered in how multiple OpenStack services validate images with backing file references. An authenticated attacker could provide a malicious image via upload, or by creating and modifying an image from an existing volume. Validation of images can be triggered durin...

CVE-2024-6314

CVE-2024-6314 affects the IQ Testimonials WordPress plugin. The Red Hat and Wordfence entries describe a vulnerability in process_image_upload that allows unauthenticated arbitrary file uploads in versions up to and including 2.2.7 due to insufficient file type validation. The impact is high: if ...

PT-2024-37535 · WordPress · Testimonials

Name of the Vulnerable Software and Affected Versions: IQ Testimonials plugin for WordPress versions up to, and including, 2.2.7 Description: The issue is related to insufficient file type validation in the process image upload function, allowing unauthenticated attackers to upload arbitrary file...

WordPress plugin IQ Testimonials security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2024-6439

A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated...

OpenStack Security Vulnerabilities

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. A security vulnerability exists in OpenStack, which stems from an input validation flaw that could allow an attacker to deliver a malicious image by uploading or creating and modifying an...

CVE-2024-6280

A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/ajax.php?action=savesettings. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack...