765 matches found
CVE-2020-9423
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...
PHPGurukul Job Portal Unauthenticated File Upload Vulnerability
PHPGurukul Job Portal is a job portal with PHP+MySQL architecture, which is divided into two modules: user side and admin panel. An unauthenticated file upload vulnerability exists in admin/gallery.php in PHPGurukul Job Portal 1.0. An unauthenticated remote attacker can exploit this vulnerability...
PHPGurukul Online Book Store Unauthenticated File Upload Vulnerability
PHPGurukul Online Book Store is a simple online web store made with php, mysql and bootstrap. An unauthenticated file upload vulnerability exists in adminadd.php in PHPGurukul Online Book Store 1.0. An unauthenticated remote attacker could use this vulnerability to upload content, including PHP...
PT-2020-11982 · Phpgurukul · Phpgurukul Online Book Store
Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Book Store version 1.0 Description: An unauthenticated file upload issue has been identified in the admin add.php file. This could be exploited by a remote attacker to upload content, including PHP files, potentially leading...
Siemens SPPA-T3000 improper authentication vulnerability (CNVD-2019-44767)
The SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. A security vulnerability exists in the Siemens SPPA-T3000. An attacker with network access to the application server could upload arbitrary files without authentication...
CVE-2019-12719
An issue was discovered in PictureManagemvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority parameter...
CVE-2019-12719
The CVE-2019-12719 entry concerns AUO SunVeillance Monitoring System, specifically Picture_Manage_mvc.aspx. Affected version: before v1.1.9e. Root cause: incorrect access control that can be bypassed via a modified authority parameter. Consequence: unauthenticated attacker can upload files, indic...
Default credentials
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...
CVE-2016-10958
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...
CVE-2019-13187
The Rich Text Formatter Redactor extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php...
CVE-2019-13187
The Rich Text Formatter Redactor extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php...
BKS EBK Ethernet-Buskoppler Pro Shell Upload
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-017 Product: BKS EBK Ethernet-Buskoppler Pro Manufacturer: BKS GmbH Affected Versions: 3.01 Vulnerability Type: Unrestricted Upload of File with Dangerous Type CWE-434 Risk Level: High Solution Status: Fixed Manufacturer...
CVE-2019-11185
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...
CVE-2019-12102
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...
CVE-2019-9951
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page...
CVE-2019-3489
An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to...
SG Optimizer <= 5.0.12 - Unauthenticated File Upload
According to the original researchers: "A successful attack on the SiteGround Optimizer would allow bad actors to store backdoors on vulnerable sites."...
CVE-2018-14707
Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations...
