WordPress WP EasyCart Plugin - Unrestricted File Upload

WP EasyCart plugin is prone to an unrestricted file upload vulnerability that exists because the /inc/amfphp/administration/banneruploaderscript.php does not properly clean up user-uploaded files. An attacker can do the script with the privileges of the web server by making a direct request to th...

WordPress Plugin WP EasyCart - Unrestricted Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WordPress WP EasyCart Unrestricted File Upload', 'Description' = %qWordPress Shopping Cart WP EasyCart Plugin for WordPress...

WordPress WP EasyCart Unrestricted File Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WordPress WP EasyCart Unrestricted File Upload', 'Description' = %qWordPress Shopping Cart WP EasyCart Plugin for WordPress...

CVE-2015-0868

CVE-2015-0868 is an unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS, affecting versions up to and including 2.90 (2.91 fixes referenced by sources). The flaw allows a remote attacker to upload an executable file and potentially execute arbitrary code on the ser...

CVE-2015-0868: Undefined Security Weakness

Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromukubu2BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file...

PT-2015-4926

Name of the Vulnerable Software and Affected Versions Mrs. Shiromuku Perl CGI shiromukubu2BBS versions prior to 2.91 Description The issue allows remote attackers to execute arbitrary code by uploading an executable file due to an unrestricted file upload vulnerability. Recommendations For versio...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct 1 cross-site scripting XSS, 2 SQL injection, or 3 unrestricted file upload attacks...

CVE-2015-1374

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct 1 cross-site scripting XSS, 2 SQL injection, or 3 unrestricted file upload attacks...

CVE-2015-1374

CVE-2015-1374 relates to multiple CSRF vulnerabilities in ferretCMS 1.0.4-alpha, specifically in admin.php, enabling remote attackers to hijack administrator authentication for requests that perform (1) XSS, (2) SQL injection, and (3) unrestricted file upload. The connected sources confirm the af...

PT-2015-5246

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description The issue allows remote administrators to execute arbitrary code by uploading a file with an executable extension to the custom/uploads/ directory, and then accessing it via a direct request. This is d...

CVE-2015-1374: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct 1 cross-site scripting XSS, 2 SQL injection, or 3 unrestricted file upload attacks...

CVE-2015-1371: Improper Input Validation

Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/...

ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-004: EMC M&R Watch4Net Multiple Vulnerabilities EMC Identifier: ESA-2015-004 CVE Identifier: CVE-2015-0513, CVE-2015-0514, CVE-2015-0515, CVE-2015-0516, CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6466, CVE-2014-6468,...

PT-2015-4680

Name of the Vulnerable Software and Affected Versions EMC M&R aka Watch4Net versions prior to 6.5u1 ViPR SRM versions prior to 3.6.1 Description The issue allows remote authenticated users to execute arbitrary code by uploading and then accessing an executable file due to an unrestricted file...

CVE-2015-0515: Undefined Security Weakness

Unrestricted file upload vulnerability in EMC M&R aka Watch4Net before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading and then accessing an executable file...

WordPress Holding Pattern Theme <= 0.6 - Unrestricted File Upload

This vulnerability allows an attacker to upload arbitrary files. The application uses limited validation which means unauthorized upload is allowed. Solution Update the theme...

CVE-2015-1059

Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads...

CVE-2015-1059

Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads...

CVE-2015-1059: Improper Control of Generation of Code

Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads...

CVE-2014-9308

Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart aka WordPress Shopping Cart plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a...