MyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: MyBB 1.8.32 - Chained LFI Remote Code Execution RCE Authenticated Date: 2023-01-19 Exploit Author: lUc1f3r11 https://github.com/FDlucifer Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1832 Version: MyBB 1.8.32 Tested on: Linux CVE :...

SUSE CVE-2021-32557

It was discovered that the processreport function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks...

Online Food Ordering System 代码问题漏洞

Online Food Ordering System is an online food ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Food Ordering System version v2.0, which originates from an arbitrary file upload vulnerability in the component /fos/admin/ajax.php, which can be...

CVE-2022-46178 Path Traversal In MeterSpere allows file upload to any path

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

VulnCheck KEV: CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

74cms 代码问题漏洞

XUNYI TECHNOLOGY 74cms is a PHP and MySQL based online recruitment system from China Xunyi Technology Company. A security vulnerability exists in version 74cmsSE v3.13.0, which stems from the /apiadmin/upload/attach component that allows an attacker to upload arbitrary files, resulting in the...

CVE-2022-36572

Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution RCE vulnerability via the component /upload/admin.php?/deal/...

Sinsiu Enterprise Website System 安全漏洞

Sinsiu Enterprise Website System is a Sinsiu Enterprise Website System from Sinsiu. A security vulnerability exists in Sinsiu Enterprise Website System version v1.1.1.0, which originates from a Remote Code Execution RCE vulnerability discovered via the component /upload/admin.php?/deal/...

GHSA-5469-C5P2-XV5G Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem...

LDAP Account Manager 注入漏洞

LDAP Account Manager is a web front-end for managing entries in stored LDAP directories e.g., users, groups, DHCP settings. versions prior to LDAP Account Manager 8.0 contain an injection vulnerability that could be exploited by an attacker to write a web-shell to the /lam/tmp/ directory and gain...

PortlandLabs Concrete CMS 路径遍历漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS is vulnerable to an arbitrary file deletion vulnerability that stems from allowing traversal of /index.php/ccm/system/file/ upload, which can be exploited by...

CSCMS Music Portal System 跨站请求伪造漏洞

CSCMS Music Portal System is a multifaceted content management system from China Chongsheng Network Technology CSCMS. A cross-site request forgery vulnerability exists in CSCMS Music Portal System v4.2, which originates from a cross-site request forgery CSRF vulnerability in...

GHSA-9848-V244-962P Withdrawn Advisory: Apache Struts XSS

Withdrawn Advisory This advisory has been withdrawn because it was deemed invalid. This link is maintained to preserve external references. Original Description Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML...

GHSA-V49X-8HVM-Q347 Exposure of Sensitive Information in Apache Pluto

The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain...

USU Oracle Optimization 代码问题漏洞

USU Oracle Optimization is used to improve Oracle query performance.A deserialization vulnerability exists in versions of USU Oracle Optimization prior to 5.17, which originates from the Java deserialization of /v2/quantum/save-data-upload-big-file, and an attacker can exploit this vulnerability ...

Scriptcase 9.7 - Remote Code Execution Exploit

Exploit Title: Scriptcasr 9.7 arbitrary file upload getshell Exploit Author: luckyt0mat0 Vendor Homepage: https://www.scriptcase.net/ Software Link: https://www.scriptcase.net/download/ Version: 9.7 Tested on: Windows Server 2019 Proof of Concept: POST...

newbee-mall 代码问题漏洞

newbee-mall is an e-commerce system. newbee-mall v1.0.0 has a security vulnerability that can be exploited by attackers to upload arbitrary files via the upload function of /admin/goods/edit...

PT-2022-18205 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the /cgi-bin/uploadWeiXinPic component. Recommendations: For Tenda M3 version 1.10 V1.0.0.124856, consider restricting access to the...

Tensent SentCMS 代码问题漏洞

Tensent SentCMS is an easy-to-use website management system from Tensent, China. A security vulnerability exists in Tensent SentCMS version 4.0.x. The vulnerability stems from a lack of validation of uploaded files in the file upload interface of the /user/upload/upload php code in the software...

KiteCMS 代码问题漏洞

KiteCMS is a content management system based on think php. An arbitrary file upload vulnerability exists in /admin/upload/uploadfile in KiteCMS version 1.1. An attacker can exploit the vulnerability getshell via a specially crafted PHP file...