CVE-2026-86305 light0011 cms Upload.class.php upload unrestricted upload

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted...

CVE-2026-86305: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted...

CVE-2023-34747: Unrestricted Upload of File with Dangerous Type

File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload...

PT-2022-16775

Name of the Vulnerable Software and Affected Versions sentcms versions 4.0.x Description The issue allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution in the /admin/upload/upload endpoint. Recommendations For sentc...

PT-2022-16774

Name of the Vulnerable Software and Affected Versions sentcms versions 4.0.x Description The issue allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through the "/user/upload/upload" API endpoint. Recommendations...

CVE-2022-24651: Unrestricted Upload of File with Dangerous Type

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /user/upload/upload...

CVE-2022-24652: Unrestricted Upload of File with Dangerous Type

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload...

PT-2019-7552

Name of the Vulnerable Software and Affected Versions Kliqqi version 3.0.0.5 Description The issue allows for CSRF with resultant Arbitrary File Upload. This is possible because the "module.php?module=upload" endpoint can be used to configure the uploading of .php files, and then the...

Cross site request forgery (csrf)

In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the configuploadclass value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an...

CVE-2018-9848

In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the configuploadclass value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an...

CVE-2018-9848: Improper Control of Generation of Code

In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the configuploadclass value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an...

PT-2018-19072

Name of the Vulnerable Software and Affected Versions Gxlcms QY version 1.0.0713 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved by first changing the configupload class value to include 'php' using an Admin-Admin-Configsave request, and then making a...

PT-2012-3010

Name of the Vulnerable Software and Affected Versions Apache Struts version 1.3.10 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters to certain API endpoints. The vulnerable parameters include the name parameter to...