Cisco Small Business RV Series Authentication Bypass and Command Injection

This module exploits an authentication bypass CVE-2021-1472 and command injection CVE-2021-1473 in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the...

Authentication flaw

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. In addition, an upload endpoint could then be used by an authenticated...

CVE-2020-28970

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. In addition, an upload endpoint could then be used by an authenticated...

CVE-2020-25042

An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated admin/manager session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php...

CVE-2020-15006

Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php...

U.S. Dept Of Defense: Unauthenticated arbitrary file upload on the https://█████/ (█████████)

The vulnerability involves an unauthenticated arbitrary file upload on the https://█████/ █████████ website. A test file was successfully uploaded to the /upload.php endpoint, and the uploaded file was accessible at the /delete.me path. This vulnerability could have led to consequences such as...

PT-2019-12159 · Sunnet · Sunnet Wmpro

Name of the Vulnerable Software and Affected Versions: SUNNET WMPro versions 5.0 through 5.1 Description: The issue concerns an OS Command Injection vulnerability. It can be exploited via the "/teach/course/doajaxfileupload.php" API endpoint without requiring authentication. Recommendations: For...

CVE-2019-12377

A vulnerable upl/asyncupload.asp web API endpoint in Ivanti LANDESK Management Suite LDMS, aka Endpoint Manager 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary remote code execution...

PT-2018-14968 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.5.1 Description: The issue allows remote attackers to execute arbitrary PHP code by uploading an image with the image/jpeg content type to the "zb system/admin/index.php?act=UploadMng" API endpoint. This requires...

School Attendance Monitoring System Cross-Site Request Forgery Vulnerability (CNVD-2019-00384)

School Attendance Monitoring System is a school attendance monitoring system. A cross-site request forgery vulnerability exists in School Attendance Monitoring System version 1.0. A remote attacker can exploit this vulnerability to upload arbitrary files using the event/controller.php?action=phot...

The vulnerability of the HTTP-server on the RouterOS operating system of MikroTik allows a hacker to cause a service failure.

The vulnerability of the HTTP server of the RouterOS operating system for MikroTik devices stems from the exhaustion of available memory during the loading of a file. Exploiting this vulnerability allows an attacker to cause a malfunction or a reboot of the device through a specially crafted HTTP...

PT-2018-14386 · Camaleon · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS version 2.4 Description: A Stored XSS issue has been discovered in Camaleon CMS. The profile image in the User settings section can be exploited in the update/upload area via the "admin/media/upload?actions=false" endpoint. The...

b3log Symphony Arbitrary File Upload Vulnerability

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A security vulnerability exists in b3log Symphony version 2.6.0. A remote attacker can exploit this vulnerability by sending the 'name' parameter to the...

PT-2018-17400 · WordPress · Wp-Splashing-Images

Name of the Vulnerable Software and Affected Versions: wp-splashing-images versions prior to 2.1.1 Description: The issue allows authenticated remote attackers, with roles such as administrator, editor, or author, to conduct PHP Object Injection attacks. This is achieved by sending crafted...