293 matches found
CVE-2020-5509
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...
Remote code execution
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...
CVE-2020-5509
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...
CVE-2020-5509
CVE-2020-5509 affects PHPGurukul Car Rental Project v1.0. It allows Remote Code Execution via an executable file uploaded as a new profile image, due to improper validation of uploaded files. Exploit details are described in Exploit-DB and PacketStorm reports, and PT-2020-18486 recommends restric...
CVE-2020-5509: Unrestricted Upload of File with Dangerous Type
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...
PT-2020-18486 · Phpgurukul · Phpgurukul Car Rental Project
Name of the Vulnerable Software and Affected Versions: PHPGurukul Car Rental Project version 1.0 Description: The issue allows for Remote Code Execution via an executable file in an upload of a new profile image. Recommendations: For PHPGurukul Car Rental Project version 1.0, consider restricting...
UBUNTU-CVE-2019-19206
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...
CVE-2018-18260
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."...
PT-2018-14386 · Camaleon · Camaleon Cms
Name of the Vulnerable Software and Affected Versions: Camaleon CMS version 2.4 Description: A Stored XSS issue has been discovered in Camaleon CMS. The profile image in the User settings section can be exploited in the update/upload area via the "admin/media/upload?actions=false" endpoint. The...
CVE-2018-18260
Camaleon CMS (Ruby on Rails) vulnerability CVE-2018-18260 affects version 2.4 where a Stored XSS is possible via the User settings profile image upload path. The issue is triggered when a malicious payload is processed in the update/upload area through /admin/media/upload?actions=false, allowing ...
CVE-2018-18260: Improper Neutralization of Input During Web Page Generation
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."...
CVE-2018-6860
Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture...
Arbitrary File Upload
Intelliants/subrion is vulnerable to arbitrary file upload. The application doesn't restrict the type of files which can be uploaded as a profile image. These files may be executed when the profile is rendered...
Mojoomla Annual Maintenance Contract Management System Arbitrary File Upload Vulnerability
Mojoomla Annual Maintenance Contract AMC Management System is a contract document management system. An arbitrary file upload vulnerability exists in profilesetting image handling in the Mojoomla AMC Management System. A remote attacker can exploit this vulnerability to upload arbitrary files...
Design/Logic Flaw
GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauthorized file sharing...
CVE-2016-7845
GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauthorized file sharing...
CVE-2016-7845
GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauthorized file sharing...
Arbitrary file upload vulnerability in GigaCC OFFICE
Overview GigaCC OFFICE provided by WAM!NET Japan K.K. contains a vulnerability where arbitrary files may be uploaded. WAM!NET Japan K.K. and the following people reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and WAM!NET Japan K.K. coordinated...
Arbitrary Code Execution in extension "Frontend User Registration" (sf_register)
Release Date: September 12, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 6.2.8 and below Vulnerability Type: Arbitrary Code Execution Severity: High Suggested CVSS v2.0:...