15 matches found
CVE-2024-40110
家禽养殖管理系统 v1.0 - 远程代码执行漏洞 漏洞类型 未认证文件上传导致远程代码执行 描述 家禽养殖管理系统 v1.0 的产品上传功能存在严重漏洞。该应用程序未能正确验证和清理文件上传，允许攻击者上传伪装成产品图片的 PHP 文件。这些上传的 PHP 文件可以被执行，从而实现远程代码执行。 易受攻击的端点 POST /paultry/farm/product.php 或 POST /farm/product.php 攻击向量 可通过以下方式利用该漏洞： 1. 向产品上传端点发送 POST 请求 2. 上传包含任意命令的 PHP shell 文件 3. 访问上传的文件以执行嵌入的命令...
CVE-2026-19927
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-19927
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-19927
CVE-2026-19927 affects OpenBoxes up to 0.9.7, specifically the Upload endpoint in grails-app/controllers/org/pih/warehouse/product/ProductController.groovy. The issue arises from manipulating the argument params.url, enabling a server-side request forgery (SSRF) that can be exploited remotely. Ex...
CVE-2026-19927: Server-Side Request Forgery (SSRF)
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-25328
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through = 2.2.4...
Poultry-Farm-Management-System-v1.0-RCE-POC
Poultry Farm Management System v1.0 - RCE Exploit Vulnera...
i-Educar 安全漏洞
i-Educar is a free educational software open source by Portábilis. A security vulnerability exists in i-Educar that stems from a reflected cross-site scripting vulnerability in the product upload feature...
CVE-2024-1986
The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wcaddnewproduct function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files...
Input validation
The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wcaddnewproduct function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files...
Simple eCommerce <= 2.2.5 - Arbitrary File Upload
The plugin does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE...
Online Shopping Portal 3.1 - Authentication Bypass
Exploit Title: Online Shopping Portal 3.1 - Authentication Bypass Date: 2020-06-25 Exploit Author: Ümit Yalçın Vendor Homepage: https://phpgurukul.com/shopping-portal-free-download/ Version: 3.1 Tested on: Windows 10 / WampServer 1- Authentication Bypass Go to following url!...
QCMS cross-site scripting vulnerability (CNVD-2019-10277)
QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in upload/System/Controller/backend/product.php in QCMS 3.0.1, which can be exploited by remote attackers to inject arbitrary web script or HTML...