Design/Logic Flaw

A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Post Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The identifier of this...

PT-2024-16199 · Openbi · Openbi

Name of the Vulnerable Software and Affected Versions: openBI versions up to 1.0.8 Description: A critical vulnerability was found in openBI, affecting the uploadFile function of the file /application/index/controller/File.php. This leads to unrestricted upload and can be initiated remotely. The...

PT-2024-15774 · Monitorr · Monitorr

Name of the Vulnerable Software and Affected Versions: Monitorr version 1.7.6m Description: A critical vulnerability was found in Monitorr, affecting an unknown functionality of the file /assets/php/upload.php in the Services Configuration component. The manipulation of the fileToUpload argument...

CVE-2024-0648

CVE-2024-0648 affects Yunyou CMS up to 2.2.6. The vulnerability is in /app/index/controller/Common.php where manipulating the templateFile argument leads to unrestricted file upload. It is exploitable remotely; public exploit disclosed. No patch/version fix details are provided in the connected d...

PT-2024-15712 · Unknown · C21 Live Encoder/Live Mosaic

Name of the Vulnerable Software and Affected Versions: C21 Live Encoder and Live Mosaic product version 5.3 Description: The issue allows a remote attacker to upload different file extensions without any restrictions, resulting in a full system compromise. This is due to an unrestricted upload of...

CVE-2023-48245

The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-7212

A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file fileclass.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the...

PT-2024-15234 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DeDeCMS versions up to 5.7.112 Description: A critical vulnerability has been found in DeDeCMS, affecting an unknown function of the file file class.php in the Backend component. This vulnerability leads to unrestricted upload and can be...

PT-2024-15376 · Unknown · Rrj Nueva Ecija Engineer Online Portal

Name of the Vulnerable Software and Affected Versions: RRJ Nueva Ecija Engineer Online Portal version 1.0 Description: A critical vulnerability was found in the RRJ Nueva Ecija Engineer Online Portal, affecting an unknown functionality of the file downloadable.php of the component Add Downloadabl...

CVE-2023-52252

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

Design/Logic Flaw

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

CVE-2023-52252

CVE-2023-52252 affects Unified Remote 3.13.0. The root cause is a wildcarded Access-Control-Allow-Origin header on the Remote upload endpoint, enabling remote attackers to execute arbitrary Lua code. The impact reported is remote code execution with high confidentiality/integrity/availability ris...

CVE-2023-52252

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

CVE-2023-7150

A vulnerability classified as critical was found in Campcodes Chic Beauty Salon 20230703. Affected by this vulnerability is an unknown functionality of the file product-list.php of the component Product Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. T...

CVE-2023-7147

CVE-2023-7147 affects gopeak MasterLab up to 3.3.10. The vulnerability is in the function base64ImageContent in app/ctrl/User.php; manipulation of the image argument allows unrestricted file upload and can be triggered remotely. No exploit details are provided in the documents. Remediation/status...

PT-2023-31943 · Unknown · Unified Remote

Name of the Vulnerable Software and Affected Versions: Unified Remote version 3.13.0 Description: The issue allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the "Remote upload endpoint". Recommendations: For Unified Remote version 3.13....

PT-2023-32866 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A vulnerability was found in the software, affecting unknown code of the file /upload/uploadFile. The manipulation of the file argument leads to unrestricted upload. The attack can be initiated remotely...

CVE-2023-42017

IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the...

IBM Planning Analytics 代码问题漏洞

IBM Planning Analytics is a suite of business planning analytics solutions from International Business Machines IBM. The solution supports automated execution of processes such as business planning, budgeting and analysis. A code issue vulnerability exists in IBM Planning Analytics version 2.0,...

PT-2023-32842 · Unknown · Lightxun Iptv Gateway

Name of the Vulnerable Software and Affected Versions: Lightxun IPTV Gateway versions up to 20231208 Description: A vulnerability was found in the processing of the file /ZHGXTV/index.php/admin/index/web upload template.html. The manipulation of the file argument leads to unrestricted upload. The...