1915 matches found
PT-2024-27166 · Unknown · Aimeos-Core
Name of the Vulnerable Software and Affected Versions: aimeos-core version 2024.04 Description: An arbitrary file upload vulnerability in the image upload function allows attackers to execute arbitrary code via uploading a crafted PHP file. Recommendations: For version 2024.04, update to a versio...
Remote code execution in web server context
Impact User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server...
GHSA-RHC2-23C2-WW7C Remote code execution in web server context
Impact User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server...
wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function
There is a cross-site scripting XSS issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12...
GHSA-9HFW-CVF4-5X25 wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function
There is a cross-site scripting XSS issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12...
CVE-2022-25037
An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...
CVE-2022-25037
An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...
CVE-2022-25037
An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...
CVE-2022-25037
An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...
PT-2024-11531 · Waneditor · Waneditor
Name of the Vulnerable Software and Affected Versions: wanEditor version 4.7.11 Description: The issue is related to a cross-site scripting XSS vulnerability via the image upload function. This vulnerability allows for malicious scripts to be injected into the application, potentially leading to...
GHSA-VG6X-PCHQ-98MG OpenCMS Cross-Site Scripting vulnerability
Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user: with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the title field...
CVE-2024-5518
A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file changeprofilepicture.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit ha...
CVE-2024-5521 Cross-Site Scripting stored in Alkacon OpenCMS
Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user having the roles of gallery editor or VFS resource manager will have the permission to upload images in the .svg format containing JavaScript code. The code will be...
CVE-2024-5521
The CVE-2024-5521 entry describes stored Cross-Site Scripting in Alkacon OpenCMS 16 via SVG file uploads. The root cause is improper validation of .svg images, which, when uploaded by users with gallery editor or VFS resource manager roles, allows JavaScript in the SVG to execute when another use...
WordPress SVGMagic plugin <= 1.1 - Authenticated Stored XSS via SVG Upload vulnerability
Authenticated Stored XSS via SVG Upload vulnerability discovered by Rayhan Ramdhany Hanaputra in WordPress Plugin SVGMagic versions = 1.1...
inxedu 安全漏洞
Inxedu inxedu is a set of open source online education platform from China's Inxu Times Inxedu company. The platform includes an online school system, a live broadcasting system, an examination system and a marketing website. inxedu v2.0.6 version of a security vulnerability , the vulnerability...
PT-2024-26551 · Inxedu · Inxedu
Name of the Vulnerable Software and Affected Versions: inxedu version 2.0.6 Description: The issue is related to an arbitrary file upload vulnerability in the ImageUploadController.class component. This allows attackers to execute arbitrary code by uploading a crafted jsp file. Recommendations: F...
CVE-2024-4966
A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...
CVE-2024-4921
A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /employeegatepass/classes/Users.php?f=ssave. The manipulation of the argument img leads to unrestricted upload. It is possible to...