211 matches found
CVE-2019-5096-GoAhead-Web-Server-Dos-Exploit
CVE-2019-5096: Эксплуатация Use-After-Free для DoS root@kitploit: python TriggerDOS.py ip Анализ уязвимости https://github.com/embedthis/goahead.git GoAhead githublink git diff патча Анализ ключевого кода В коде находим upload.c:370, видим, что перед root@kitploit: wp-currentFile=0 выполняется...
PanaceaSoft-0day-Exploit
PanaceaSoft-0day-Exploit PanaceaSoft все продукты 0day-эксплойт https://packetstormsecurity.com/files/157869/PanaceaSoft-Shell-Upload.html без описания читайте: jQuery File Upload's PHP Upload Handler...
CVE-2026-92919
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...
EUVD-2026-81574
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...
CVE-2026-92919 admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...
CVE-2026-92919 admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...
CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
Cisco-ASA-CVE-2025-20333-Scanner
CVE-2025-20333 Сканер Диагностический сканер на Python для Cisco ASA / FTD VPN Web Server Buffer Overflow CVE-2025-20333. CVE-2025-20333 — критическая уязвимость переполнения буфера в куче в обработчике загрузки файлов WebVPN, которая при успешной эксплуатации может привести к удаленному выполнен...
EUVD-2026-76740
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...
CVE-2026-90453
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...
CVE-2026-90453
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...
CVE-2026-90453
CVE-2026-90453 affects a file-upload handler that redirects an authenticated client's browser to a URL taken directly from the request's Referer header , without validating it against the application's own origin. An authenticated attacker can craft a request that causes another user's browser to...
CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...
CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...
CVE-2026-82238
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...
EUVD-2026-67566
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...
CVE-2026-71284
Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...
EUVD-2026-46397
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...
CVE-2026-64881 Command Injection
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...