228 matches found
CVE-2023-25202
CVE-2023-25202: Небезопасный механизм загрузки файлов Описание CVE-2023-25202 касается небезопасного механизма загрузки файлов в приложении Therefore, который слишком либерален в отношении типов файлов, разрешённых к загрузке пользователями. Приложение блокирует только загрузку HTML, EXE и BAK...
CVE-2025-54962
🔥 CVE-2025-54962 — Небезопасная загрузка файлов в веб-сервере OpenPLC Runtime OpenPLC Runtime ≤ 2024-12-31 — Хранимый XSS, CSRF 📌 Краткое описание Я обнаружил уязвимость в веб-сервере OpenPLC Runtime выпуск от 2024-12-31, которая позволяет аутентифицированным пользователям загружать произвольные...
lazyweb
LazyWeb - Уязвимое веб-приложение LazyWeb — это демонстрационное веб-приложение, предназначенное для демонстрации распространенных уязвимостей серверных приложений. Каждая уязвимость классифицирована с указанием соответствующего уровня сложности, чтобы обеспечить всесторонний опыт обучения для...
CVE-2025-60500
CVE-2025-60500 — 안전하지 않은 파일 업로드 / QDocs Smart School의 로직 결함 Smart School 7.1 공개일: 2025-10-17 작성자 / 발견자: Lebas Vivien 상태: 예약됨 CVE: CVE-2025-60500 예약됨 요약 QDocs Smart School — School Management System 7.1 의 안전하지 않은 파일 업로드 / 로직 결함으로 인해 회계accountant , 관리자admin , 또는 최고 관리자superadmin 와 같은 역할을 가진 인증된 사용자...
CVE-2023-47464
Отчет об оценке безопасности маршрутизатора GL-AX1800 Обзор В данном отчете представлены результаты комплексной оценки безопасности маршрутизатора GL-AX1800, произведенного компанией GL.iNet. Целью оценки было выявление потенциальных уязвимостей и слабых мест в мерах безопасности устройства. В хо...
CVE-2026-0911
CVE-2026-0911 — Hustle 모듈 가져오기 PoC WordPress 플러그인 Hustlewordpress-popup, WPMU DEV에 대한 CVE-2026-0911 범위 내에서, 인증이 필요한 모듈 가져오기 엔드포인트를 통한 업로드 동작을 테스트하는 연구/펜테스트 보조 도구입니다. 이 저장소 또는 파일 세트 내의 CVE-2026-0911.py 스크립트는 소유한 시스템 또는 서면 허가를 받고 테스트하는 시스템에서만 사용해야 합니다. 간단한 요약 취약점 로직 영향을 받는 버전Wordfence/NVD: 7.8.9.2 ...
CVE-2026-42538 IRIS has an Insecure File Upload
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another...
CVE-2026-42538 IRIS has an Insecure File Upload
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another...
CVE-2026-42538 IRIS has an Insecure File Upload
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another...
CVE-2018-25332
GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR...
CVE-2018-25332 GitBucket 4.23.1 Unauthenticated Remote Code Execution
GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR...
CVE-2018-25332
CVE-2018-25332 - GitBucket 4.23.1 Unauthenticated Remote Code Execution Affected software: GitBucket 4.23.1. Vulnerability: An unauthenticated remote code execution flaw exists due to weak secret token generation and insecure file upload functionality. Adversaries can brute-force the Blowfish enc...
GitBucket 访问控制错误漏洞
GitBucket is an open-source Git code hosting platform based on Scala. Version 4.23.1 of GitBucket contains a vulnerability related to access control. This vulnerability stems from the generation of weak secret tokens and the insecure file upload feature, which may allow unauthenticated attackers ...
📄 Cisco ISE 2.2 Remote Code Execution
This Metasploit module exploits an unauthorized file upload vulnerability in Cisco ISE. A ZIP file containing a JSP file with a manipulated path path traversal is uploaded. The webshell is then extracted to the webapps folder...
📄 Pachno 1.0.6 Shell Upload
Pachno version 1.0.6 suffers from a remote shell upload vulnerability. The multipart file parameter to the /uploadfile endpoint allows authenticated users to upload files directly to the server. File upload must be enabled by an admin, who can also configure the storage path, within a...
CVE-2025-14014 Insecure File Upload in NTN Informatics' Smart Panel
Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. Smart Panel allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Smart Panel: before 20251215...
CVE-2025-14014 Insecure File Upload in NTN Informatics' Smart Panel
Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. Smart Panel allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Smart Panel: before 20251215...
Interinfo DreamMaker security vulnerabilities
Interinfo DreamMaker is an application developed by Interinfo Corporation in China. Versions of Interinfo DreamMaker prior to October 22, 2025, contained security vulnerabilities. These vulnerabilities stemmed from the file upload function not restricting dangerous file types, which could lead to...
CVE-2025-33015
CVE-2025-33015 affects IBM Concert Software versions 1.0.0 through 2.1.0. The issue is a file upload vulnerability where the web interface does not validate the uploaded file’s content, enabling malicious file uploads. The CVSS metrics indicate a high severity (8.8) with network attack vector, no...
