Generex CS141 Code Issue Vulnerability

The Generex CS141 is a series of Ethernet adapters from the German company Generex. A code issue exists in the Generex CS141 prior to version 2.06, which stems from an unrestricted file upload. The vulnerability can be exploited to upload or delete any type of file in the "upload" directory witho...

K14574: PHP vulnerability CVE-2012-1172

Security Advisory Description PHP has been cited with the following vulnerability, which may be locally exploitable on some F5 products: The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid open square bracket characters in name values, which makes it...

SUSE CVE-2004-1148

phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sqllocalfile parameter...

CVE-2022-39812

Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request not possible using the GUI to an arbitrary directory. Because th...

Design/Logic Flaw

PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to...

CVE-2022-46158 Potential Information exposure in the upload directory in PrestaShop

PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to...

PrestaShop has potential Information exposure in the upload directory

Impact Potential Information exposure in the upload directory. Patches Patch in PrestaShop 1.7.8.8 References https://capec.mitre.org/data/definitions/87.html Thanks to DZPATROL...

GHSA-9QGP-9WWC-V29R PrestaShop has potential Information exposure in the upload directory

Impact Potential Information exposure in the upload directory. Patches Patch in PrestaShop 1.7.8.8 References https://capec.mitre.org/data/definitions/87.html Thanks to DZPATROL...

PT-2022-27775 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.7.8.8 Description: PrestaShop is an open-source e-commerce solution where versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. This could allow users to view the contents of the...

Exploit for Unrestricted Upload of File with Dangerous Type in Formidable_Project Formidable

CVE-2022–29622: Invulnerability Analysis This codebase was...

CVE-2022-22914

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

CVE-2022-22914

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

CVE-2022-22914

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

Ovidentia 路径遍历漏洞

Ovidentia is an open source content management system and collaboration platform based on PHP and MySQL from the French team CANTICO Cantico, which can be used for publishing and managing projects, publication and article management, schedule sharing, and more. A path traversal vulnerability exis...

Exploit for Unrestricted Upload of File with Dangerous Type in Amentotech Workreap

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthentic...

Design/Logic Flaw

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...

CVE-2021-29022

InvoicePlane 1.5.11 is affected by CVE-2021-29022, where the upload feature discloses the full path of the file upload directory. Affected component: the upload handling mechanism in InvoicePlane; root cause indicated by public records as a path disclosure. Impact is limited to confidentiality (p...

InvoicePlane 代码问题漏洞

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. A code issue vulnerability exists in InvoicePlane version 1.5.11. The vulnerability allows an attacker to obtain the full path to the file upload...

Design/Logic Flaw

Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain...

PT-2021-7096 · WordPress · Tatsu Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Tatsu WordPress plugin versions prior to 3.3.12 Description: The issue is related to the add custom font action in the Tatsu WordPress plugin, which can be used without prior authentication to upload a rogue zip file. This file is uncompresse...