PHPGurukul Job Portal Unauthenticated File Upload Vulnerability

PHPGurukul Job Portal is a job portal with PHP+MySQL architecture, which is divided into two modules: user side and admin panel. An unauthenticated file upload vulnerability exists in admin/gallery.php in PHPGurukul Job Portal 1.0. An unauthenticated remote attacker can exploit this vulnerability...

PT-2020-11982 · Phpgurukul · Phpgurukul Online Book Store

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Book Store version 1.0 Description: An unauthenticated file upload issue has been identified in the admin add.php file. This could be exploited by a remote attacker to upload content, including PHP files, potentially leading...

Siemens SPPA-T3000 improper authentication vulnerability (CNVD-2019-44767)

The SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. A security vulnerability exists in the Siemens SPPA-T3000. An attacker with network access to the application server could upload arbitrary files without authentication...

CVE-2019-12719

An issue was discovered in PictureManagemvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority parameter...

CVE-2019-12719

The CVE-2019-12719 entry concerns AUO SunVeillance Monitoring System, specifically Picture_Manage_mvc.aspx. Affected version: before v1.1.9e. Root cause: incorrect access control that can be bypassed via a modified authority parameter. Consequence: unauthenticated attacker can upload files, indic...

Default credentials

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...

CVE-2016-10958

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...

CVE-2019-13187

The Rich Text Formatter Redactor extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php...

CVE-2019-13187

The Rich Text Formatter Redactor extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php...

BKS EBK Ethernet-Buskoppler Pro Shell Upload

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-017 Product: BKS EBK Ethernet-Buskoppler Pro Manufacturer: BKS GmbH Affected Versions: 3.01 Vulnerability Type: Unrestricted Upload of File with Dangerous Type CWE-434 Risk Level: High Solution Status: Fixed Manufacturer...

CVE-2019-11185

The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...

CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...

CVE-2019-9951

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page...

CVE-2019-3489

An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to...

SG Optimizer <= 5.0.12 - Unauthenticated File Upload

According to the original researchers: "A successful attack on the SiteGround Optimizer would allow bad actors to store backdoors on vulnerable sites."...

CVE-2018-14707

Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations...

CVE-2018-14707

Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations...

CVE-2018-9209

Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server = v1.2.2...

CVE-2018-9208

Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut = v1.1Beta...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...