158 matches found
CVE-2024-48239
An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...
CVE-2024-48239
An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...
CVE-2024-48239
An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...
CVE-2024-48239
A Cross-Site Scripting (XSS) vulnerability exists in WTCMS version 1.0 , a ThinkPHP-based content management system. The root cause is the unprocessed application parameters within the plupload method located in the AssetController.class.php file. An attacker can exploit this by injecting a craft...
WTCMS security vulnerabilities
wtcms is a ThinkPHP-based content management system CMS. A cross-site scripting vulnerability exists in version 1.0 of wtcms, which stems from unprocessed application parameters in the plupload method in the file AssetController.class.php, and can be exploited by an attacker to execute arbitrary...
CVE-2024-48239: Improper Neutralization of Input During Web Page Generation
An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...
PT-2024-33050 · Wtcms · Wtcms
Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: An issue in the plupload method within the AssetController.class.php file allows for Cross Site Scripting XSS due to unprocessed app parameters. Recommendations: For WTCMS version 1.0, consider disabling the...
CVE-2024-48239
An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...
SUSE CVE-2016-4566
Cross-site scripting XSS vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution SOME attack...
Unrestricted File Upload
microweber/microweber is vulnerable to unrestricted file upload. The sanitization filter bypass in plupload.php allows a remote authenticated attacker to upload files outside the intended locations...
CSRF attack while uploading files on [/plupload] via GET request
Description The application is applying a technique to protect itself from CSRF attacks by sending the CSRF token on the cookies and checking the value on the backend and also check the referer header, the CSRF token is deleted from the cookies if the request comes from another origin and just...
Code injection in plupload
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
GHSA-RP2C-JRGP-CVR8 Code injection in plupload
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
@gdyfe/tools (>=1.0.0, <=1.0.10), icetest-test (1.0.1) +6 more potentially affected by CVE-2021-23562 via plupload (>=2.3.2, <=2.3.6)
plupload NPM version =2.3.2, =1.0.0, =1.0.1, =1.0.0, =0.0.28, =0.2.4, =1.0.5, =0.0.0, =0.0.37 Source cves: CVE-2021-23562 Source advisory: GHSA-RP2C-JRGP-CVR8...
@gdyfe/tools (>=1.0.0, <=1.0.10), icetest-test (1.0.1) +6 more potentially affected by CVE-2021-23562 via plupload (>=2.3.2, <=2.3.6)
plupload NPM version =2.3.2, =1.0.0, =1.0.1, =1.0.0, =0.0.28, =0.2.4, =1.0.5, =0.0.0, =0.0.37 Source cves: CVE-2021-23562 Source advisory: OSV:GHSA-RP2C-JRGP-CVR8...
Unspecified Vulnerability in Plupload
Plupload is a cross-browser, multi-runtime file upload API. A security vulnerability exists in versions of plupload prior to 2.3.9 that allows an attacker to upload and run files containing JavaScript code...
Cross-site Scripting (XSS)
plupload is vulnerable to cross-site scripting. The vulnerability exists in addFiles function of jquery.ui.plupload.js because the html entities have not been encoded properly which allows an malicious attacker to perform unauthorized file uploads...
CVE-2021-23562
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...
