PT-2023-20879 · Atrocore · Atrocore

Name of the Vulnerable Software and Affected Versions: Atrocore version 1.5.25 Description: The Create Import Feed option with the glyphicon-glyphicon-paperclip function in Atrocore is vulnerable to unauthenticated file upload. This issue allows unauthorized users to upload files without proper...

CVE-2023-26968

CVE-2023-26968 affects Atrocore 1.5.25: the Create Import Feed option with the glyphicon-glyphicon-paperclip function is vulnerable to unauthenticated file upload. CVSS v3.1 shows/quotes a Critical rating (9.8) with Network access, no privileges, no user interaction required, and high impact to c...

CVE-2021-33224

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file...

CVE-2022-41217

Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage...

CVE-2022-41217 Cloudflow - Unauthenticated file upload vulnerability

Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage...

CVE-2022-41217

Cloudflow (CVE-2022-41217) suffers an unauthenticated file upload vulnerability affecting the CLOUDFLOW PROOFSCOPE built-in storage. The issue enables an attacker to upload malicious files without authentication, with CVSS v3.1 metrics indicating Network access, Low attack complexity, No privileg...

Atrocore 1.5.25 Shell Upload

Title: atrocore-1.5.25 User interaction - Unauthenticated File upload - RCE Author: nu11secur1ty Date: 02.16.2023 Vendor: https://atropim.com/ Software: https://github.com/atrocore/atrocore/releases/tag/1.5.25 Reference: https://portswigger.net/web-security/file-upload Description: The Create...

Monitorr 1.7.6 Shell Upload Exploit

Exploit Title: Monitorr v1.7.6 - Unauthenticated File upload to Remote Code Execution Exploit Author: Achuth V P retrymp3 Vendor Homepage: https://github.com/Monitorr/ Software Link: https://github.com/Monitorr/Monitorr Tested on: Ubuntu Version: v1.7.6 Exploit Description: Monitorr v1.7.6 suffer...

Monitorr 1.7.6 Shell Upload

Exploit Title: Monitorr v1.7.6 - Unauthenticated File upload to Remote Code Execution Exploit Author: Achuth V P retrymp3 Date: February 09, 2023 Vendor Homepage: https://github.com/Monitorr/ Software Link: https://github.com/Monitorr/Monitorr Tested on: Ubuntu Version: v1.7.6 Exploit Description...

CVE-2022-45896

Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution...

VulnCheck KEV: CVE-2022-45359

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress...

CVE-2022-3921 Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE...

WordPress plugin Booking Calendar 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Booking Calendar version...

PT-2022-27476 · Yith · Yith Woocommerce Gift Cards

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Gift Cards premium plugin versions 3.19.0 and earlier Description: The issue is related to an Unauth. Arbitrary File Upload vulnerability in the YITH WooCommerce Gift Cards premium plugin on WordPress, which allows unauthoriz...

CVE-2022-42698

Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin = 1.1.0 on WordPress...

PT-2022-6235 · Cisco · Cisco Rv345 +3

Name of the Vulnerable Software and Affected Versions: Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers affected versions not specified Description: A vulnerability in the web-based management interface of the affected devices could allow an unauthenticated, remote attacker to...

Zengenti Contensis Classic 授权问题漏洞

Zengenti Contensis Classic is a content management system from Zengenti UK. A security vulnerability exists in Zengenti Contensis Classic prior to version 15.2.1.79, which stems from a file upload wizard that fails to properly check if a user has been authenticated. The vulnerability can be...

CVE-2022-2594

The CVE-2022-2594 entry concerns the WordPress plugins Advanced Custom Fields (ACF) and Advanced Custom Fields Pro (ACF Pro) prior to version 5.12.3. Affects ACF and ACF Pro when a frontend form is available, allowing unauthenticated users to upload files permitted by default WordPress configurat...

Personnel Property Equipment 2015-2022 SQL Injection Vulnerability

Title: Personnel Property Equipment-2015-2022 SQLi, Unauthenticated-File-Upload Author: nu11secur1ty Vendor Homepage: https://www.trickcode.in/ Video vendor: https://www.youtube.com/watch?v=ltSwom8sQAQ Software https://www.trickcode.in/2021/03/personnel-property-equipment-system.html Reference:...

Personnel Property Equipment 2015-2022 SQL Injection

Title: Personnel Property Equipment-2015-2022 SQLi, Unauthenticated-File-Upload Author: nu11secur1ty Date: 08.22.2022 Vendor Homepage: https://www.trickcode.in/ Video vendor: https://www.youtube.com/watch?v=ltSwom8sQAQ Software...