Deskfiler Security Vulnerability

Deskfiler is a desktop file manager. A security vulnerability exists in Deskfiler v1.2.3 that originated from allowing an attacker to execute arbitrary code by uploading a specially crafted plug-in...

CVE-2024-25291

Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin...

CVE-2024-25291

Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin...

CVE-2024-25291

Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin...

Coppermine Gallery 1.6.25 - RCE

Exploit Title: coppermine-gallery 1.6.25 RCE Application: coppermine-gallery Version: v1.6.25 Bugs: RCE Technology: PHP Vendor URL: https://coppermine-gallery.net/ Software Link: https://github.com/coppermine-gallery/cpg1.6.x/archive/refs/tags/v1.6.25.zip Date of found: 05.09.2023 Author: Mirabba...

PT-2023-6470 · Unknown · I-Doit Open +1

Name of the Vulnerable Software and Affected Versions: I-doit pro versions 25 and below I-doit open versions 25 and below Description: The issue is related to weak password requirements for Administrator account creation in the affected software. This weakness allows attackers to easily guess...

Textpattern CMS Path Traversal Vulnerability

Textpattern CMS is a Php-based content management system from the Textpattern team. A security vulnerability exists in Textpattern CMS version v4.8.8. A remote attacker can exploit the vulnerability to execute arbitrary code and access sensitive information via the plugin upload function...

CVE-2023-36220

CVE-2023-36220 is a directory traversal vulnerability affecting Textpattern CMS v4.8.8. The issue allows a remote authenticated attacker to execute arbitrary code and access sensitive information via the plugin Upload function. Multiple connected sources corroborate the affected product/version a...

Exploit for Weak Password Requirements in I-Doit

CVE-2023-37756 – Weak Password Requirement in admin-center lea...

OpenCart SQL注入漏洞

OpenCart is an open source online shopping system that allows you to build your own online store. The system is simple and easy to use and supports all kinds of data import and export , including product information , user orders , products and so on. Through OpenCart users can easily complete th...

Jenkins: Temporary plugin file created with insecure permissions

A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...

Textpattern CMS 4.8.8 Command Injection

Exploit Title: Textpattern CMS v4.8.8 - Command Injection Authenticated Date: 2023-06-15 Exploit Author: tmrswrr Vendor Homepage: https://textpattern.com/ Software Link: https://textpattern.com/filedownload/118/textpattern-4.8.8.zip Version: v4.8.8 Tested : https://release-demo.textpattern.co/ --...

Jenkins: Temporary plugin file created with insecure permissions

A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...

CVE-2023-27899

A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...

GHSA-HF9H-VV4M-2F33 Incorrect Authorization in Jenkins Core

Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 creates this temporary file in the system temporary directory with the default permissions for newly created files. If these...

CVE-2022-42925

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection...

PT-2022-26659 · Forma Lms · Forma Lms

Name of the Vulnerable Software and Affected Versions: Forma LMS versions 3.1.0 and earlier Description: The issue allows an authenticated attacker with the role of student to privilege escalate and upload a Zip file through the plugin upload component. This could lead to a remote code injection...

CVE-2022-42189

Emlog Pro 1.6.0 plugins upload suffers from a remote code execution RCE vulnerability...

Exploit for Improper Preservation of Permissions in Processmaker

This repository has be archived and moved to: https://github.com...

GHSA-5469-C5P2-XV5G Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem...