CVE-2022-47769

An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell...

Trend Micro Apex One 代码问题漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro. A security vulnerability exists in Trend Micro Apex One server version 11110, which arises from the use of an incorrectly formatted Content-Length header in its HTTP PUT message that allows an unauthenticated, remote attack...

Correos Oficial <= 1.3.0.0 - Unauthenticated Arbitrary File Download

The plugin does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server. PoC Dependency: WooCommerce plugin Use the following curl command to download the contents of the wp-config.php file:...

CVE-2022-4101 Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack...

FileOrbis File Management System 路径遍历漏洞

FileOrbis File Management System is a file server management product from FileOrbis, Inc. A path traversal vulnerability exists in FileOrbis File Management System versions prior to 10.6.3, which stems from an unauthenticated local file inclusion and path traversal vulnerability in the file...

CVE-2022-45896

Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution...

VulnCheck KEV: CVE-2022-45359

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress...

CVE-2022-3921 Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE...

WordPress plugin Booking Calendar 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Booking Calendar version...

PT-2022-27476 · Yith · Yith Woocommerce Gift Cards

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Gift Cards premium plugin versions 3.19.0 and earlier Description: The issue is related to an Unauth. Arbitrary File Upload vulnerability in the YITH WooCommerce Gift Cards premium plugin on WordPress, which allows unauthoriz...

CVE-2022-42698

Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin = 1.1.0 on WordPress...

Clinic's Patient Management System 1.0 - Unauthenticated RCE

This module exploits an unauthenticated file upload vulnerability in Clinic's Patient Management System 1.0. An attacker can upload a PHP web shell and execute it by leveraging directory listing enabled on the /pms/userimages directory. Module Options msf use...

PT-2022-6235 · Cisco · Cisco Rv345 +3

Name of the Vulnerable Software and Affected Versions: Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers affected versions not specified Description: A vulnerability in the web-based management interface of the affected devices could allow an unauthenticated, remote attacker to...

Welcart eCommerce < 2.7.8 - Unauthenticated Arbitrary File Access

The plugin does not validate user input used in a path, which could allow unauthenticated users to read arbitrary files via a traversal attack...

CVE-2022-3124 Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server...

CVE-2022-40980

A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with access to the Management Server to delete files. This issue was resolved in 9.8 SP5 Critical Patch 2...

EUVD-2022-39775

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly...

Zengenti Contensis Classic 授权问题漏洞

Zengenti Contensis Classic is a content management system from Zengenti UK. A security vulnerability exists in Zengenti Contensis Classic prior to version 15.2.1.79, which stems from a file upload wizard that fails to properly check if a user has been authenticated. The vulnerability can be...

CVE-2022-2594

The CVE-2022-2594 entry concerns the WordPress plugins Advanced Custom Fields (ACF) and Advanced Custom Fields Pro (ACF Pro) prior to version 5.12.3. Affects ACF and ACF Pro when a frontend form is available, allowing unauthenticated users to upload files permitted by default WordPress configurat...

Personnel Property Equipment 2015-2022 SQL Injection

Title: Personnel Property Equipment-2015-2022 SQLi, Unauthenticated-File-Upload Author: nu11secur1ty Date: 08.22.2022 Vendor Homepage: https://www.trickcode.in/ Video vendor: https://www.youtube.com/watch?v=ltSwom8sQAQ Software...