199 matches found
webuploader-0.1.15-Demo
Le composant webuploader-v-0.1.15 présente une vulnérabilité de téléversement de fichiers non authentifiée Description : Le composant Baidu WebUploader présente une vulnérabilité de téléversement de fichiers. Cette vulnérabilité est due au filtrage insuffisant des types de fichiers ou des...
CVE-2026-57827
CVE-2026-57827 Скрипт обнаружения и эксплуатации уязвимости CVE-2026-57827 неавторизованная загрузка файлов в Joomla RSFiles...
CVE-2021-21972
CVE-2021-21972 VMware vSphere Client : téléversement de fichier non autorisé menant à l'exécution de code à distance RCE Le client Web vSphere HTML5 est essentiellement une interface d'administration qui permet de gérer une installation vSphere. Le client vSphere donne à l'administrateur accès au...
CVE-2023-22518
Exploit CVE-2023-22518 Description Ce dépôt contient un script d'exploitation pour CVE-2023-22518. Le script permet des téléversements de fichiers non autorisés, pouvant conduire à une exécution de code à distance ou à d'autres vulnérabilités de sécurité. Avertissement Ce dépôt est à des fins...
CVE-2026-77269
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...
CVE-2026-32639
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...
CVE-2026-32639: Authentication Bypass by Alternate Name
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...
CVE-2026-58428
The Git repository management system Gitea is vulnerable to an attachment extension allowlist bypass via the web release edit form. An authenticated remote attacker with repository write permissions can exploit flaws in the EditReleasePost() function (in routers/web/repo/release.go) and the Updat...
PT-2026-55262
Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description An unauthenticated arbitrary file upload issue exists in the com.sksoft.bill.ImageUpload servlet. Unauthenticated attackers can upload arbitrary files by submitting a POST request to the endpoint without...
CVE-2026-38329
Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...
CVE-2026-35573
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The...
Exploit for Unrestricted Upload of File with Dangerous Type in Webfulcreations Computer_Repair_Shop
CVE-2024-51793 / 0-Click RCE Exploit - Author: Joshua Provost...
CVE-2021-22736
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a denial of service when an unauthorized file is uploaded...
CVE-2019-18320
A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to upload arbitrary files without authentication. Please note that an attacker needs to have network access to the...
CVE-2025-14045: Missing Authorization
The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the urlmediauploaderurluploadajaxhandler function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-leve...
PT-2025-47787
Name of the Vulnerable Software and Affected Versions S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress versions through 1.7.8 Description The software is susceptible to arbitrary file uploads because of a lack of file type validation within the storeFile...
EUVD-2017-16959
Malware in sbrugna...
EUVD-2019-5856
Malware in sbrugna...