CVE-2024-48239

An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...

wtcms 安全漏洞

wtcms is a ThinkPHP-based content management system CMS. A cross-site scripting vulnerability exists in version 1.0 of wtcms, which stems from unprocessed application parameters in the plupload method in the file AssetController.class.php, and can be exploited by an attacker to execute arbitrary...

CVE-2024-48239

WTCMS 1.0 is affected by a Cross Site Scripting (XSS) vulnerability in the plupload method of AssetController.class.php, where unprocessed application parameters enable injection of arbitrary web script/HTML. This is documented across CVE-2024-48239 family sources (NVD, Red Hat, CNVD, CNVD CNVD, ...

SUSE CVE-2016-4566

Cross-site scripting XSS vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution SOME attack...

Unrestricted File Upload

microweber/microweber is vulnerable to unrestricted file upload. The sanitization filter bypass in plupload.php allows a remote authenticated attacker to upload files outside the intended locations...

CSRF attack while uploading files on [/plupload] via GET request

Description The application is applying a technique to protect itself from CSRF attacks by sending the CSRF token on the cookies and checking the value on the backend and also check the referer header, the CSRF token is deleted from the cookies if the request comes from another origin and just...

Code injection in plupload

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

GHSA-RP2C-JRGP-CVR8 Code injection in plupload

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

@gdyfe/tools (>=1.0.0 <=1.0.10), icetest-test (=1.0.1) +6 more potentially affected by CVE-2021-23562 via plupload (>=2.3.2 <=2.3.6)

plupload NPM version =2.3.2, =1.0.0, =1.0.1, =1.0.0, =0.0.28, =0.2.4, =1.0.5, =0.0.0, =0.0.37 Source cves: CVE-2021-23562 Source advisory: OSV:GHSA-RP2C-JRGP-CVR8...

Unspecified Vulnerability in Plupload

Plupload is a cross-browser, multi-runtime file upload API. A security vulnerability exists in versions of plupload prior to 2.3.9 that allows an attacker to upload and run files containing JavaScript code...

Cross-site Scripting (XSS)

plupload is vulnerable to cross-site scripting. The vulnerability exists in addFiles function of jquery.ui.plupload.js because the html entities have not been encoded properly which allows an malicious attacker to perform unauthorized file uploads...

CVE-2021-23562

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

CVE-2021-23562

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

CVE-2021-23562

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

UBUNTU-CVE-2021-23562

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

CVE-2021-23562 Arbitrary File Upload

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

CVE-2021-23562

This CVE affects the plupload package prior to v2.3.9. The vulnerability allows a file name containing JavaScript code to be uploaded and executed, requiring social engineering to entice a user to upload such a file. The root cause is insufficient validation of uploaded file names that may contai...

Plupload 代码问题漏洞

Plupload is a cross-browser, multi-runtime file upload API. A security vulnerability exists in versions of plupload prior to 2.3.9 that allows an attacker to upload and run files containing JavaScript code...

Cross-site Scripting (XSS)

plupload is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the file.name field as it does not properly encode the user input file name...

@gdyfe/tools (>=1.0.0 <=1.0.10), icetest-test (=1.0.1) +6 more potentially affected by CVE-2021-23562 via plupload (>=2.3.2 <=2.3.6)

plupload NPM version =2.3.2, =1.0.0, =1.0.1, =1.0.0, =0.0.28, =0.2.4, =1.0.5, =0.0.0, =0.0.37 Source cves: CVE-2021-23562 Source advisory: SNYK:JS-PLUPLOAD-1583909...