CVE-2021-28977

Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...

CVE-2021-28977

Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...

CVE-2021-28976

CVE-2021-28976 affects GetSimpleCMS versions prior to 3.3.16, with a remote code execution vulnerability in admin/upload.php exploitable through PHAR file uploads. The connected sources confirm a phar-based attack chain leading to RCE (e.g., PoCs and exploits in Exploit-DB/PacketStorm) and indica...

CVE-2021-28976

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...

Group Office CRM Server-Side Request Forgery Vulnerability

Group Office CRM is an enterprise CRM and component tool with email client, shared projects, calendar, documents and more. A server-side request forgery vulnerability exists in Group Office CRM version 6.4.196, which can be exploited by a remote attacker to forge a GET request to any URL via the...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

CVE-2020-15006

Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php...

CVE-2020-15006

Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php...

PHPKB Multi-Language 9 image-upload.php Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution Exploit Author: Antonio Cannito Vendor Homepage: https://www.knowledgebase-script.com/ Software Link: https://www.knowledgebase-script.com/pricing.p...

PHPKB Multi-Language 9 - image-upload.php Authenticated Remote Code Execution

PHPKB Multi-Language 9 - image-upload.php Authenticated Remote Code Execution Exploit Title: PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution Google Dork: N/A Date: 2020-03-15 Exploit Author: Antonio Cannito Vendor Homepage: https://www.knowledgebase-script.com/...

CVE-2020-10212

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the...

CVE-2020-10212

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the...

CVE-2020-10212

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the...

CVE-2011-2933

CVE-2011-2933: Affected software is WebsiteBaker 2.8.1 and earlier. The vulnerability is an Arbitrary File Upload in admin/media/upload.php caused by failure to restrict uploaded files with extensions .htaccess, .php4, .php5, and .phtl. Connected sources confirm this现. The provided documents do n...

CVE-2015-9471

CVE-2015-9471 affects the WordPress plugin dzs-zoomsounds (2.0), where an admin/upload.php arbitrary file upload vulnerability exists. The issue is tied to the dzs-zoomsounds WordPress plugin and results in potential unauthorized file uploads via its admin interface. The initial description state...

CVE-2016-10995

The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via singleupload.php or single-upload.php...

Default credentials

The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via singleupload.php or single-upload.php...

Design/Logic Flaw

A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because...

CVE-2019-14315

The CVE-2019-14315 entry documents a cross-site scripting (XSS) vulnerability in SunHater KCFinder where upload.php is affected in versions 3.20-test1, 3.20-test2, 3.12 and earlier. The root cause involves improper handling of input that allows an attacker to inject arbitrary web script or HTML v...

CVE-2018-20526

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php...