3049 matches found
CVE-2022-0440 Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog ie DISALLOWUNFILTEREDHTML, DISALLOWFILEEDIT and DISALLOWFILEMODS...
CVE-2022-0440: Unrestricted Upload of File with Dangerous Type
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog ie DISALLOWUNFILTEREDHTML, DISALLOWFILEEDIT and DISALLOWFILEMODS...
CVE-2021-24216: Unrestricted Upload of File with Dangerous Type
The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations...
CVE-2022-25016
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /studentattendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-25411
A Remote Code Execution RCE vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-25411
A Remote Code Execution RCE vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-25411
A Remote Code Execution RCE vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-25411
A Remote Code Execution RCE vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2021-24820
The Cost Calculator WordPress plugin through 1.6 allows authenticated users Contributor+ in versions 1.5, and Admin+ in versions = 1.6 to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout...
Sourcecodester Hospital Patient Records Management System本地文件包含漏洞
Sourcecodester Hospital Patient Records Management System is a web-based application that provides hospitals with an automated platform to store and manage their patient records. sourcecodester Hospital Patient Record Management System v1.0 contains a local file inclusion vulnerability that can b...
PT-2022-9471
Name of the Vulnerable Software and Affected Versions Cost Calculator WordPress plugin versions prior to 1.7 Description The issue allows authenticated users with certain permissions to perform path traversal and local PHP file inclusion on Windows Web Servers. This is achieved via the Cost...
PT-2022-17275
Name of the Vulnerable Software and Affected Versions Maxsite CMS version v180 Description A Remote Code Execution RCE issue exists at the "/admin/options" API endpoint, allowing attackers to execute arbitrary code via a crafted PHP file. Recommendations For Maxsite CMS version v180, consider...
CVE-2021-24820: Improper Limitation of a Pathname to a Restricted Directory
The Cost Calculator WordPress plugin through 1.6 allows authenticated users Contributor+ in versions 1.5, and Admin+ in versions = 1.6 to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout...
Server-Side Request Forgery (SSRF)
Description The SSRF Protection is incomplete and can be bypassed via an HTTP redirect, the python-requests library will follow redirections by default can be disabled byallowredirects=False. An attacker can set up their HTTP server to respond with a 302 redirect to redirect the request to...
CVE-2021-44664
An Authenticated Remote Code Exection RCE vulnerability exists in Xerte through 3.9 in websitecode/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files...
CVE-2022-24232
A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
Remote file inclusion
A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...