POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system public, private, etc. This module accepts any uploaded file extension, including dangerous file formats so it can be used to bypass the...

Drupal POST File module < 1.0.2 - Authenticated Multiple Vulnerabilities vulnerability

Authenticated Multiple Vulnerabilities vulnerability discovered by Pierre Rudloff in WordPress Module POST File versions 1.0.2...

PT-2024-10479 · Drupal · Drupal Post File

Name of the Vulnerable Software and Affected Versions: Drupal POST File versions 0.0.0 through 1.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can enable a remote attacker to conduct cross-site...

PT-2024-10478 · Post File +1 · Post File +1

Name of the Vulnerable Software and Affected Versions: Drupal POST File versions 0.0.0 through 1.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the POST File module of the Drupal CMS system. This vulnerability can be exploited by a remote attacker to...

Drupal POST File module < 1.0.2 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff in WordPress Module POST File versions 1.0.2...

PT-2023-32050 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information. Recommendations: At the momen...

PT-2023-31501 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions up to 5.7.100 Description: A critical issue has been found in DedeCMS, affecting an unknown functionality of the file /include/dialog/select templets post.php. The manipulation of the activepath argument leads to absolute pat...

WordPress Plugin php-mod/curl 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2022-9951 · Unknown · Php-Mod/Curl

Name of the Vulnerable Software and Affected Versions: php-mod/curl versions prior to 2.3.2 Description: The issue allows for XSS attacks via the post file path upload.php key parameter and the POST data to post multidimensional.php. This can potentially lead to malicious script execution. No...

Code injection

An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2018-19088)

MiniCMS is a mini content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/post.php file in MiniCMS versions prior to 1.10, which can be exploited by remote attackers to inject arbitrary Web script or HTML with the help of the 'tag'...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2018-18140)

MiniCMS is a mini content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the post.php file in MiniCMS version 1.10. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'date'...

IBM Proventia Network Mail Security System 2.5 POST File Read

No description provided by source. !/usr/bin/python ''' Author: muts of Offensive Security Product: IBM ISS Proventia Mail Security Version: 2.5 Vendor Site: http://www.ibm.com/us/en/ Product Page: http://www-935.ibm.com/services/us/en/it-services/proventia-network-mail-security-system.html...

Metasploit Framework 3.6.0 Released !

In coordination with Metasploit Express and Metasploit Pro, version 3.6 of the Metasploit Framework is now available. Hot on the heels of 3.5.2, this release comes with 8 new exploits and 12 new auxiliaries. A whopping 10 of those new auxiliary modules are Chris John Riley's foray into SAP, givin...

PT-2005-4445 · Xmb · Xmb

Name of the Vulnerable Software and Affected Versions: XMB version 1.9.2 Description: The issue allows remote attackers to obtain the installation path. This is achieved by providing an invalid fid parameter in a newthread action to the post.php file. Recommendations: For XMB version 1.9.2,...