CVE-2022-40037

An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile...

Command injection

An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile...

Rawchen blog-ssm 代码问题漏洞

blog-ssm is a JavaWeb-based blog project by the individual developer Rawchen in China. A security vulnerability exists in Rawchen blog-ssm v1.0 that could allow a remote attacker to elevate privileges and execute arbitrary commands via the component /upFile...

PT-2023-13745 · Unknown · Rawchen Blog-Ssm

Name of the Vulnerable Software and Affected Versions: Rawchen blog-ssm version 1.0 Description: An issue in Rawchen blog-ssm allows a remote attacker to escalate privileges and execute arbitrary commands via the component "/upFile". Recommendations: For Rawchen blog-ssm version 1.0, consider...

CVE-2022-40037

An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile...

CVE-2022-40037: Unrestricted Upload of File with Dangerous Type

An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile...

FeMiner wms 代码问题漏洞

FeMiner wms is a repository management system for individual developers of the Chinese front-end miner FeMiner. A security vulnerability exists in FeMiner wms, which stems from some unknown functionality in the file /product/savenewproduct.php?flag=1, where the operation of the parameter upfile...

CVE-2022-4272

A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The...

CVE-2022-4272: Incorrect Privilege Assignment

A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The...

CVE-2022-44087

ESPCMS P8.21120101 was discovered to contain a remote code execution RCE vulnerability in the component UPFILEPICZOOMHIGHT...

EARCLINK ESPCMS 安全漏洞

Honghu Erchuang Netlink Information Technology EARCLINK ESPCMS is an enterprise website building system from Honghu Erchuang Netlink Information Technology, China. A security vulnerability exists in EARCLINK ESPCMS version P8.21120101, which originated from the discovery of a Remote Code Executio...

SQL injection vulnerability in the background up***.php file of Shield Spirit Original Article Submission System

The Shield Spirit Original Article Submission System is a concise submission system. A SQL injection vulnerability exists in the background up.php file of Shield Spirit Original Article Submission System. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Arbitrary file deletion vulnerability in ECS CMS of Honghu Erchuang Netlink Information Technology Co.

ESPCMS is a free and professional CMS for building enterprise websites. Honghu Erchuang Netlink Information Technology Co., Ltd. ESPCMS arbitrary file deletion vulnerability, attackers can use the vulnerability to intercept and delete upfile under the file packet, rewrite the packet to cause all...

CVE-2018-20528

JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter...

CVE-2018-20528: Server-Side Request Forgery (SSRF)

JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter...

PT-2018-15414

Name of the Vulnerable Software and Affected Versions JEECMS version 9 Description The issue concerns a Server-Side Request Forgery SSRF vulnerability. It is related to the upfile parameter in the /ueditor/getRemoteImage.jspx API endpoint. This allows for potential unauthorized access and...

PT-2018-14580

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.11 Description The issue concerns SQL injection in the spider.admincp.php file of iCMS. This occurs because the content of upfile is base64 decoded, deserialized, and then used for database insertion, specifically through the...

Onethink Ueditor Server-Side Request Forgery Vulnerability

Onethink is a content management framework for web development based on ThinkPHP.Ueditor is one of the HTML editors. A server-side request forgery vulnerability exists in the getRemoteImage.php file of Ueditor in Onethink version 1.0 and 1.1. A remote attacker can exploit this vulnerability with...

CVE-2017-14323

SSRF Server Side Request Forgery in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter...

CVE-2017-14323

SSRF Server Side Request Forgery in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter...