CVE-2014-9134

Huawei Honor Cube Wireless Router WS860s (before V100R001C02B222) has an Unrestricted file upload vulnerability (CVE-2014-9134) that enables remote attackers to execute arbitrary code by uploading a file with an executable extension and then accessing it via unspecified vectors. The advisory HWPS...

IBM WebSphere Portal 7.0.0.x < 7.0.0.2 CF29 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is 7.0.0.x prior to 7.0.0.2 CF29. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Apache Struts ClassLoader. A remote attacker can exploit this issue by manipulating the...

Digi Online Examination System 2.0 Shell Upload

Exploit Title: Digi Online Examination System Unrestricted File Upload Vulnerability Date: 12-10-2014 Exploit Author: Halil Dalabasmaz Version: v2.0 Software Link: http://codecanyon.net/item/digi-online-examination-system-does/8610180 Software Test Link: http://s1.digitalvidhya.com/doesv2/...

CVE-2014-8770

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI aka Magento Mass Importer plugin 0.7.17a and earlier for Magento Community Edition CE allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP fil...

CVE-2014-8770

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI aka Magento Mass Importer plugin 0.7.17a and earlier for Magento Community Edition CE allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP fil...

Serenity Client Management Portal 1.0.1 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Serenity Client Management Portal Multiple Vulnerabilities Date: 08-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.0.1 Software Link: http://codecanyon.net/item/serenity-client-management-portal/9136098 Software Test Link:...

Serenity Client Management Portal 1.0.1 Cross Site Scripting

Exploit Title: Serenity Client Management Portal Multiple Vulnerabilities Date: 08-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.0.1 Software Link: http://codecanyon.net/item/serenity-client-management-portal/9136098 Software Test Link: http://www.zenperfectdesign.com/demo/serenity-cc/...

Digi Online Examination System 2.0 - Unrestricted File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Digi Online Examination System Unrestricted File Upload Vulnerability Date: 12-10-2014 Exploit Author: Halil Dalabasmaz Version: v2.0 Software Link: http://codecanyon.net/item/digi-online-examination-system-does/8610180 Software...

WordPress Plugin Photo Gallery 1.2.5 - Unrestricted Arbitrary File Upload

WordPress Plugin Photo Gallery 1.2.5 - Unrestricted Arbitrary File Upload Exploit Title: Photo Gallery 1.2.5 Unrestricted File Upload Date: 11-11-2014 Software Link: https://wordpress.org/plugins/photo-gallery/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

WordPress Photo Gallery by Supsystic plugin <=1.2.5 - Unrestricted File Upload

WordPress Photo Gallery by Supsystic plugin unrestricted file upload vulnerability allows an access to upload functionality via "UploadHandler.php". Solution Update to version 1.2.6...

WordPress Photo Gallery Unrestricted File Upload

Photo Gallery Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the photo-gallery\photo-gallery.php script allows access to filemanager\UploadHandler.php. The post method in UploadHandler.php does not properly verify or...

Serenity Client Management Portal 1.0.1 - Multiple Vulnerabilities

Serenity Client Management Portal 1.0.1 - Multiple Vulnerabilities Exploit Title: Serenity Client Management Portal Multiple Vulnerabilities Date: 08-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.0.1 Software Link: http://codecanyon.net/item/serenity-client-management-portal/9136098 Softwa...

Serenity Client Management Portal 1.0.1 - Multiple Vulnerabilities

Exploit Title: Serenity Client Management Portal Multiple Vulnerabilities Date: 08-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.0.1 Software Link: http://codecanyon.net/item/serenity-client-management-portal/9136098 Software Test Link: http://www.zenperfectdesign.com/demo/serenity-cc/...

Serenity Client Management Portal Multiple Vulnerabilities

Serenity is a light-weight, PHP-based online client management application that is built for freelancers. Focused on the intimate relationship between freelancers and their clients, Serenity makes heavy use of the jQuery library and AJAX protocols to do powerful things with little effort and to...

HelpDEZk 1.0.1 Unrestricted File Upload

Advisory ID: HTB23239 Product: HelpDEZk Vendor: HelpDEZk Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 15, 2014 without technical details Vendor Notification: October 15, 2014 Public Disclosure: November 5, 2014 Vulnerability Type: Unrestricted...

CVE-2014-5298

FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated...

CVE-2014-3947

Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors...

Unrestricted file upload

Unrestricted file upload vulnerability in the mmforum extension before 1.9.3 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors...

CVE-2014-6298

CVE-2014-6298 refers to an unrestricted file upload vulnerability in the TYPO3 extension mm_forum (versions 1.9.2 and below). The issue enables remote code execution when an attacker uploads a file with an executable extension and accesses it via unspecified vectors, due to insufficient input/fil...

WordPress Plugin Category and Page Icons Multiple Vulnerabilities

WordPress Plugin 'Category and Page Icons' have suffers from multiple vulnerabilities File Deletion/File Upload. Exploit Title : WordPress Plugin 'Category and Page Icons' Multiple Vulnerabilities Exploit Author : NULLPointer Date : 2014-09-29 Download Link :...