109 matches found
CVE-2022-4633 Auto Upload Images Settings setting-page.php cross-site request forgery
A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request forgery. The attack may be launched...
CVE-2022-4633 Auto Upload Images Settings setting-page.php cross-site request forgery
A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request forgery. The attack may be launched...
CVE-2022-4632: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue...
CVE-2022-4632 Auto Upload Images cross site scripting
A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue...
CVE-2022-4632
CVE-2022-4632 affects Auto Upload Images up to version 3.3.0. It describes a cross-site scripting flaw in an unknown functionality that can be triggered remotely (attack vector: NETWORK) with user interaction required and no privileges. Upgrading to version 3.3.1 fixes the issue (patch identifier...
CVE-2022-4632 Auto Upload Images cross site scripting
A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue...
Auto Upload Images 跨站请求伪造漏洞
Auto Upload Images is designed to automatically detect external images in post content and import the images into your site and add them to the media library. A cross-site request forgery vulnerability exists in Auto Upload Images version 3.3.1, which stems from some unknown functions in the...
PT-2022-24969 · Unknown · Jerryhanjj Erp
Name of the Vulnerable Software and Affected Versions: jerryhanjj ERP affected versions not specified Description: A critical vulnerability was found in jerryhanjj ERP, affecting the uploadImages function of the file application/controllers/basedata/inventory.php in the Commodity Management...
WordPress Auto Upload Images plugin <= 3.3 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Rasi Patchstack Alliance in the WordPress Auto Upload Images plugin versions = 3.3. Solution No patched version is available. No reply from the vendor...
CVE-2022-2091: Cross-Site Request Forgery (CSRF)
The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF attack...
CVE-2021-24757
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spluploadserimg AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload images...
Enjin: Unrestricted Upload of File with Dangerous Type
The security researcher was able to execute CWE-434: Unrestricted Upload of File with Dangerous Type through a legacy API endpoint used to upload images. This file was directly upload to our CDN with the appropriate MIME time of the file...
CVE-2020-26803
In Sentrifugo 3.2, users can upload an image under "Assets - Add" tab. This "Upload Images" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server...
CVE-2020-26803
In Sentrifugo 3.2, users can upload an image under "Assets - Add" tab. This "Upload Images" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server...
PT-2020-16491
Name of the Vulnerable Software and Affected Versions Sentrifugo version 3.2 Description The issue affects the "Upload Images" functionality under the "Assets - Add" tab, where users can upload malicious files due to an "Unrestricted File Upload" vulnerability. This allows an attacker to upload...
Bludit Directory Traversal Vulnerability
Bludit is an open source, lightweight blog content management system CMS. A security vulnerability exists in Bludit version 3.9.2. A remote attacker can exploit this vulnerability to execute code with the help of the bl-kernel/ajax/upload-images.php file...
CVE-2019-17629
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...
CVE-2019-17629
CMS Made Simple (CMSMS) 2.2.11 is affected by a stored cross‑site scripting (XSS) flaw. An admin can inject malicious content via a crafted image filename in the file manager > upload images screen, which is stored and later rendered in the application. The root cause is not explicitly detaile...
PT-2019-15237
Name of the Vulnerable Software and Affected Versions CMS Made Simple versions 2.2.11 Description The issue allows for stored XSS by an admin via a crafted image filename on the "file manager upload images" screen. Recommendations For version 2.2.11, update to a newer version that contains a fix...
CVE-2019-17629: Improper Neutralization of Input During Web Page Generation
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...