Node.js third-party modules: [Uppy] Internal Server side request forgery (bypass of #786956)

I would like to report Internal Server-side request forgery in Uppy It allows the attacker to easily extract information from internal servers Module module name: Uppy version:1.15.0 npm page: https://www.npmjs.com/package/uppy Module Description Uppy is a sleek, modular JavaScript file uploader...

Arbitrary file upload vulnerability in phpok backend

PHPOK system hereinafter referred to as OK system is a content management system for website construction developed by Shenzhen Kunshu Technology Co. A file upload vulnerability exists in the backend of PHPOK, which can be exploited by attackers to gain access to the server...

File upload vulnerability in beescms backend

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A file upload vulnerability exists in the beescms backend. An attacker can exploit the vulnerability to upload malicious files and gain server privileges...

File Upload Vulnerability in OKCMS Web Content Management System of Zibo Oukai Information Technology Co.

Zibo Oukai Information Technology Co., Ltd. is a localized Internet company specializing in station building + promotion + operation in one. A file upload vulnerability exists in the OKCMS web content management system of Zibo Oukai Information Technology Co. An attacker can exploit the...

Command execution vulnerability in PbootCMS Pa***.php file

PbootCMS is an open source and free PHP enterprise web development and construction management system. PbootCMS Pa.php file has a command execution vulnerability. An attacker can exploit this vulnerability to execute arbitrary php code and gain server privileges...

SimplePHPGal 0.7 Remote File Inclusion

Title: SimplePHPGal 0.7 - Remote File Inclusion Author: h4shur date:2020-05-05 Vendor Homepage: https://johncaruso.ca Software Link: https://johncaruso.ca/phpGallery/ Software Link: https://sourceforge.net/projects/simplephpgal/ Tested on: Windows 10 & Google Chrome Category : Web Application Bug...

File Upload Vulnerability in ERP Management Platform of Chengdu Tianwen Internet Technology Co.

Based on software development and technical services, Chengdu Tianwen Interlink Technology Co., Ltd. establishes property ERP application system and provides property management companies with intelligent property management solutions aiming at cost reduction, quality assurance and efficiency...

File upload vulnerability in Waychar enrollment system

waychar online registration system, is an online registration system developed for sports events and other general events, supporting public numbers and small programs. A file upload vulnerability exists in the Waychar registration system, which can be exploited by attackers to upload malicious...

Shenzhen Microcosmos Interactive Limited Wecenter Learning Free Edition has a file upload vulnerability

WeCenter is an open source knowledge-based social Q&A community program that focuses on organizing, categorizing and retrieving community content, and distributing it by connecting to the WeChat public platform and mobile APP. Shenzhen WeCenter has a file upload vulnerability that can be exploite...

Sichuan Zhongwang Shengteng Technology Co., Ltd. school management system has logic flaws and vulnerabilities

The Academic Management System AMS is a management system that displays departmental information for the school and publishes relevant notices and announcements and school news. There is a logic flaw vulnerability in the system that can be exploited by an attacker to gain administrator privileges...

Command Execution Vulnerability in CRMEB Open Edition V3.1.0

CRMEB mall system is based on ThinkPhp6.0 + Vue development of a set of new retail mobile e-commerce system, CRMEB system is a set of customer relationship management + marketing e-commerce system, can quickly accumulate customers, member data analysis, intelligent conversion of customers,...

Code Execution Vulnerability in ETA CMS (CNVD-2020-26408)

ETA CMS is a simple, practical and efficient website builder. A code execution vulnerability exists in EDA CMS, which can be exploited by an attacker to gain control of a web server...

CVE-2020-7575

A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitra...

CVE-2018-16871

A flaw was found in the Linux kernel's NFS implementation. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the...

Mcms has a file upload vulnerability (CNVD-2020-27934)

Mcms is a web site building system of MINGFEI TECHNOLOGY CO. Mcms suffers from a file upload vulnerability that can be exploited by an attacker to gain server administrator privileges...

WordPress Plugin Event-Registration Arbitrary File Upload Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. An arbitrary file upload vulnerability exists in the WordPress plugin Event-Registration,...

JunAms content management system suffers from a file upload vulnerability (CNVD-2020-24740)

JunAMS is an open source content management system with ThinkPHP as its framework. JunAMS content management system has a file upload vulnerability that can be exploited by an attacker to upload a webshell and gain server privileges...

File Upload Vulnerability in Scarecrow Enterprise Website

The Inari Enterprise Station is an open source simple and compact free enterprise website system based on PHP+Sqlite/MySQL. Scarecrow Enterprise Station has a file upload vulnerability that can be exploited by attackers to gain access to the web server...

JunAms content management system suffers from a file upload vulnerability (CNVD-2020-24739)

JunAMS is an open source content management system with ThinkPHP as its framework. JunAMS content management system has a file upload vulnerability that can be exploited by an attacker to write a webshell and gain server privileges...

File Upload Vulnerability in Enterprise Website Building System of Zibo Shining Network Technology Co.

Zibo Shining Network Technology Co., Ltd. enterprise station-building system a specialized enterprise station-building solutions for the product. There is a file upload vulnerability in the Zibo Shining Network Technology Co., Ltd. system that can be exploited by an attacker to gain access to the...