File Upload Vulnerability in Bludit CMS v3.13.0

Bludit CMS is a foreign multilingual lightweight website CMS system. Bludit CMS v3.13.0 suffers from a file upload vulnerability, which can be exploited by attackers to gain administrative privileges on the server...

Piggy CMS LifeTone O2O website building system has a logic flaw vulnerability

Piggy cms life pass o2o system card coupon o2o, community o2o is a more innovative characteristics of the o2o program source code, the platform is designed to attract fans, growth of the flow of life, is to build a localized life service priority o2o choice. Pig CMS life pass O2O station building...

Unspecified vulnerability in jupyterhub-kubespawner

jupyterhub-kubespawner is a package for spawning single-user laptop servers on Kubernetes clusters. A security vulnerability in versions of jupyterhub-kubespawner prior to 0.12 can be exploited by an attacker to access the default server of another user with the same username...

YCCMS suffers from a file upload vulnerability (CNVD-2020-48966)

YCCMS is a PHP version of a lightweight CMS builder. YCCMS has a file upload vulnerability, which can be exploited by attackers to upload malicious files to gain server control privileges...

Directory traversal

An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sutsrv.exe web application served on TCP port 85 includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the...

WonderCMS Directory Traversal Vulnerability

WonderCMS is a PHP-based content management system. A directory traversal vulnerability exists in WonderCMS, which can be exploited to delete arbitrary files via directory traversal on the operating system using web server access...

Authorization

An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022...

File Upload Vulnerability in SDCMS

Times Web Information Management System abbreviation: SDCMS is a portal system developed with asp+access. A file upload vulnerability exists in SDCMS. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Arbitrary File Upload Vulnerability in Central Rong Technology Development Group Limited's Website Building System

Ltd. is an IT industry solutions and technical services provider, covering mobile application software development, system software development, artificial intelligence, big data and so on, a comprehensive large-scale technical services company. There is an arbitrary file upload vulnerability in...

h1-ctf: [h1-2006 2020] Chained vulnerabilities lead to account takeover

Summary Mårten Mickos lost his account for BountyPay, the new service HackerOne is using to pay bug bounties. In this report I explain how I accessed a customer's account using a log file and bypassed its 2FA validation. I then leverage an open redirect bug to gain access to an internal server an...

File upload vulnerability in BEESCMS backend ad***_pi***_up***.php page

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A file upload vulnerability exists in the adpiup.php page in the BEESCMS backend. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Command Execution Vulnerability in Free Version of Kilo Brokerage Guarantee System

Kile Intermediary is a TP5.1-based intermediary secured transactions system, Kile Intermediary secured transactions system is a professional virtual asset intermediary secured transactions system, the program can be used to do domain names, websites, accounts, small programs, WeChat public number...

Node.js third-party modules: [Uppy] Internal Server side request forgery (bypass of #786956)

I would like to report Internal Server-side request forgery in Uppy It allows the attacker to easily extract information from internal servers Module module name: Uppy version:1.15.0 npm page: https://www.npmjs.com/package/uppy Module Description Uppy is a sleek, modular JavaScript file uploader...

Arbitrary file upload vulnerability in phpok backend

PHPOK system hereinafter referred to as OK system is a content management system for website construction developed by Shenzhen Kunshu Technology Co. A file upload vulnerability exists in the backend of PHPOK, which can be exploited by attackers to gain access to the server...

File upload vulnerability in beescms backend

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A file upload vulnerability exists in the beescms backend. An attacker can exploit the vulnerability to upload malicious files and gain server privileges...

File Upload Vulnerability in OKCMS Web Content Management System of Zibo Oukai Information Technology Co.

Zibo Oukai Information Technology Co., Ltd. is a localized Internet company specializing in station building + promotion + operation in one. A file upload vulnerability exists in the OKCMS web content management system of Zibo Oukai Information Technology Co. An attacker can exploit the...

Command execution vulnerability in PbootCMS Pa***.php file

PbootCMS is an open source and free PHP enterprise web development and construction management system. PbootCMS Pa.php file has a command execution vulnerability. An attacker can exploit this vulnerability to execute arbitrary php code and gain server privileges...

SimplePHPGal 0.7 Remote File Inclusion

Title: SimplePHPGal 0.7 - Remote File Inclusion Author: h4shur date:2020-05-05 Vendor Homepage: https://johncaruso.ca Software Link: https://johncaruso.ca/phpGallery/ Software Link: https://sourceforge.net/projects/simplephpgal/ Tested on: Windows 10 & Google Chrome Category : Web Application Bug...

File Upload Vulnerability in ERP Management Platform of Chengdu Tianwen Internet Technology Co.

Based on software development and technical services, Chengdu Tianwen Interlink Technology Co., Ltd. establishes property ERP application system and provides property management companies with intelligent property management solutions aiming at cost reduction, quality assurance and efficiency...

File upload vulnerability in Waychar enrollment system

waychar online registration system, is an online registration system developed for sports events and other general events, supporting public numbers and small programs. A file upload vulnerability exists in the Waychar registration system, which can be exploited by attackers to upload malicious...