3400 matches found
CVE-2021-44911
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restrict...
Unrestricted file upload
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restrict...
CVE-2021-44911
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restrict...
GHSA-5Q5W-MQP6-G2GH Unrestricted Upload of File with Dangerous Type in jsdecena/laracom
jsdecena/laracom prior to version 2.0.9 is vulnerable to Unrestricted Upload of File with Dangerous Type...
CVE-2022-0472
CVE-2022-0472 affects the Packagist package jsdecena/laracom prior to version 2.0.9. The root cause is an Unrestricted Upload of File with Dangerous Type , enabling an attacker with a valid account (per the Huntr PoC) to upload files such as HTML that can contain scripts. This can lead to content...
Unrestricted Upload of File with Dangerous Type in motionEye
motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...
CVE-2021-46013
An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "" gets uploaded it is saved into /uploads/examquestion/...
CVE-2021-46013
An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "" gets uploaded it is saved into /uploads/examquestion/...
CVE-2021-46013
An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "" gets uploaded it is saved into /uploads/examquestion/...
CVE-2021-46013
CVE-2021-46013 affects Sourcecodester Free school management software 1.0. The vulnerability is an unrestricted file upload in the exam_question uploads path that allows remote code execution via a uploaded PHP webshell (example: ) saved under /uploads/exam_question/. This leads to high-impact ou...
CVE-2022-0263
CVE-2022-0263 relates to pimcore/pimcore prior to 10.2.7, where there is an unrestricted upload of dangerous file types via the file upload feature. The root cause is lack of validation/sanitation for uploaded file types, enabling attackers to upload malicious files. Reported impact includes high...
CVE-2021-38697
SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution...
Free School Management Software 代码问题漏洞
Free School Management Software is a free and open source school software by Gosfem Individual Developer. A code issue vulnerability exists in Free school management software that stems from an unrestricted file upload vulnerability. An attacker could use this vulnerability to enable remote code...
Unrestricted file upload
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0...
Unrestricted file upload
crater is vulnerable to Unrestricted Upload of File with Dangerous Type...
Crater Invoice Crater 代码问题漏洞
Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. Crater Invoice crater suffers from a code issue vulnerability that stems from the unrestricted upload of dangerous types o...
CVE-2021-43973
An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file...
CVE-2021-43973
An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file...
CVE-2022-22117
Directus contains a Cross-Site Scripting vulnerability in its media upload flow (versions 9.0.0-alpha.4 through 9.4.1) where unrestricted HTML file uploads can be used as a profile avatar. A low-privilege attacker can upload a crafted HTML file, and when an admin or another user opens it, the XSS...