CVE-2009-1446

Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details ar...

CVE-2009-1447: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/...

CVE-2009-1446: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details ar...

CVE-2008-6750

CVE-2008-6750 affects FlexPHPDirectory 0.0.1, where add.php allows unrestricted file uploads. An attacker can upload a file with an executable extension and then access it directly under photo/ to execute code remotely. The underlying issue is unrestricted upload handling in the web application, ...

CVE-2008-6750: Improper Input Validation

Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photo/...

CVE-2008-6751: Improper Input Validation

Unrestricted file upload vulnerability in index.php in the Twitter Clone TClone plugin for ReVou Micro Blogging allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in settings/myphoto...

CVE-2008-6684: Improper Input Validation

Unrestricted file upload vulnerability in editimage.php in Apartment Search Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a GIF header, then accessing this file via a direct request to a renamed file in MemberAdmin/logo/...

CVE-2008-6677: Improper Control of Generation of Code

Unrestricted file upload vulnerability in fckeditor251/editor/filemanager/connectors/asp/upload.asp in QuickerSite 1.8.5 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2008-6660: Undefined Security Weakness

Unrestricted file upload vulnerability in bigdump.php in Alexey Ozerov BigDump 0.29b allows remote attackers to execute arbitrary code by uploading a file with an executable extension followed by a .sql extension, then accessing this file via a direct request. NOTE: some of these details are...

CVE-2008-6619

CVE-2008-6619 affects ClassSystem 2.3, via an unrestricted file upload vulnerability in class/ApplyDB.php that allows remote attackers to execute arbitrary code by uploading a file with an executable extension and accessing it through a direct request to the file in class/UploadHomepage/. The con...

CVE-2008-6617: Undefined Security Weakness

Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/...

CVE-2008-6612: Improper Control of Generation of Code

Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/...

CVE-2008-6619: Undefined Security Weakness

Unrestricted file upload vulnerability in class/ApplyDB.php in ClassSystem 2.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in class/UploadHomepage/...

CVE-2008-6568: Improper Input Validation

Unrestricted file upload vulnerability in Yehe 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the envoyer feature. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-6541

The CVE-2008-6541 entry describes an unrestricted file upload vulnerability in the DotNetNuke file manager module prior to version 4.8.2. Remote administrators could upload arbitrary files and gain server privileges via unspecified vectors. Affected product: DotNetNuke, component: file manager mo...

CVE-2008-6541: Improper Input Validation

Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors...

CVE-2008-6530

The CVE-2008-6530 entry describes an Unrestricted file upload in editimage.php of eZoneScripts Living Local 1.1 . The vulnerability permits remote authenticated administrators to upload a file with an executable extension and then access it directly to execute arbitrary PHP code. This can comprom...

CVE-2008-6530: Undefined Security Weakness

Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

CVE-2008-6518

CVE-2008-6518 describes an unrestricted file upload vulnerability in the profile feature of VidiScript. The issue allows registered, remote authenticated users to execute arbitrary code by uploading a PHP file as an Avatar and then accessing it via a direct request. The core vulnerability is the ...

CVE-2008-6518: Improper Control of Generation of Code

Unrestricted file upload vulnerability in the profile feature in VidiScript allows registered remote authenticated users to execute arbitrary code by uploading a PHP file as an Avatar, then accessing the avatar via a direct request...