yahoo YUI2 跨站脚本漏洞

YUI is a JavaScript and CSS library of YUI Library open source. yahoo YUI2 has a cross-site scripting vulnerability that originates from up.php sam.php renderhidden.php removechildren.php removeall.php readd.php overflow.php newnode2.php newnod has cross-site scripting vulnerability newnode2.php ...

CVE-2022-39179

College Management System v1.0 - Authenticated remote code execution. An admin user the authentication can be bypassed using SQL Injection that mentioned in my other report can upload .php file that contains malicious code via student.php file...

CVE-2022-43146

An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-26747 · Unknown · Restaurant Pos System

Name of the Vulnerable Software and Affected Versions: Restaurant POS System version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the add product.php file, which allows attackers to execute arbitrary code via a crafted PHP file. This can be achieved by...

PT-2022-22819 · Ucms · Ucms

Name of the Vulnerable Software and Affected Versions: UCMS version 1.6 Description: The issue allows for arbitrary file upload via the ucms/sadmin/file PHP file. Recommendations: For version 1.6, consider restricting access to the ucms/sadmin/file PHP file to minimize the risk of exploitation...

CVE-2022-34025

Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...

CVE-2021-41661

Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessible through the /uploads directory. This can lead to RCE on the web server by uploading a PHP webshell...

CVE-2022-27140

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...

CVE-2022-23880

An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-0440

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog ie DISALLOWUNFILTEREDHTML, DISALLOWFILEEDIT and DISALLOWFILEMODS...

Xerte 代码问题漏洞

Xerte is an open source software from The Xerte Project community in the UK. Xerte is vulnerable to a code issue where a maliciously crafted php file can be uploaded via a project interface disguised as a language file to bypass upload filters. An attacker could exploit the vulnerability to...

The vulnerability of the FUDforum internet forum, related to the lack of measures taken to protect the website structure, allows a perpetrator to execute arbitrary code.

The vulnerability of the FUDforum internet forum is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to inject arbitrary code during the administrator’s email reading process. This code can then...

CVE-2021-40909

Cross site scripting XSS vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial v1 by oretnom23, allows remote attackers to execute arbitrary code via the firstname, lastname, and email parameters to /ajaxcrud...

ProjectWorlds Online Shopping System 跨站请求伪造漏洞

Projectworlds Online Shopping System is an online shopping system from the Austrian company Projectworlds.A security vulnerability exists in Projectworlds Online Shopping System PHP, which stems from a CSRF vulnerability in ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in...

CVE-2021-41646

Remote Code Execution RCE vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters...

RGCMS 代码问题漏洞

RGCMS is a web CMS. v1.06 of RGCMS contains a security vulnerability that can be exploited by attackers to execute arbitrary code via a crafted .txt file, which will later be changed to a PHP file...

WordPress 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Easy Social Icons plugin is a WordPress open source application plugin. WordPress Easy Social Icons plugin in...

CVE-2021-29377

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt...

Egavilan Media Bakeshop Online Ordering System 代码问题漏洞

Egavilan Media Bakeshop Online Ordering System is a Javascript-based code repository that supports interaction with git repositories from Egavilan Media. A security vulnerability exists in Online Ordering System 1.0 that allows the upload of arbitrary .php files, which could lead to remote code...

PT-2021-11913 · Zenphoto · Zenphoto

Name of the Vulnerable Software and Affected Versions: Zenphoto versions 1.5.7 and earlier Description: The issue allows for authenticated arbitrary file upload, leading to remote code execution. An attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop file...