PT-2020-16930

Name of the Vulnerable Software and Affected Versions SourceCodester Online Library Management System version 1.0 Description The issue allows remote code execution via the "admin/borrower/index.php?view=add" endpoint because .php files can be uploaded to "admin/borrower/photos" under the web roo...

CVE-2020-28130: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos under the web root...

CVE-2020-27956

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

PT-2020-16879

Name of the Vulnerable Software and Affected Versions SourceCodester Car Rental Management System version 1.0 Description The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the...

CVE-2020-27956: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

CVE-2020-12841: Cross-Site Request Forgery (CSRF)

ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php...

CVE-2020-24195

An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution...

PT-2020-15649

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Bike Rental version 1.0 Description The issue allows an authenticated administrator to perform remote code execution through an arbitrary file upload in the Upload Image component. Recommendations For version 1.0, update...

CVE-2020-24195: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution...

CVE-2019-8293

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2019-8293

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

PT-2019-18970

Name of the Vulnerable Software and Affected Versions upload-image-with-ajax version 1.0 Description A logic error in the code allows arbitrary files to be uploaded to the web root, enabling code execution. Recommendations For upload-image-with-ajax version 1.0, consider disabling the file upload...

CVE-2019-8293: Unrestricted Upload of File with Dangerous Type

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2016-10758

PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the imagename parameter...

zzcms cross-site scripting vulnerability (CNVD-2019-13261)

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in the /uploadimgform.php file in ZZCMS version 8.3. A remote attacker can exploit this vulnerability to inject arbitrary HTML or web scripts with the help of the 'noshuiyin' parameter...

CVE-2018-17413

XSS exists in zzcms v8.3 via the /uploadimgform.php noshuiyin parameter...

OFCMS backend ueditor uploadImage file upload vulnerability

OFCMS is a content management system based on Java technology. A backend ueditor uploadImage file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files without taking into account the file.jsp::$DATA of the...

CVE-2019-9609

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/comn/service/editUploadImage URI...

CVE-2019-9608

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...

FineCMS 1.0 - Multiple Vulnerabilities

FineCMS 1.0 - Multiple Vulnerabilities Exploit Title: FineCMS 1.0 Multiple Vulnerabilities Dork: N/A Date: 29.08.2017 Vendor Homepage : http://mvc.net.pl/ Software Link: https://github.com/andrzuk/FineCMS Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author:...