471 matches found
CVE-2018-14728
upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter...
CVE-2018-14728
upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter...
CVE-2018-14728: Server-Side Request Forgery (SSRF)
upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter...
CVE-2018-14334
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
CVE-2018-14334: Unrestricted Upload of File with Dangerous Type
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
CVE-2018-11523
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files...
CVE-2018-11523
CVE-2018-11523 : The NUUO NVRmini 2 series (NUUO NVRmini 2, NVRsolo) is affected by a vulnerability in upload.php that enables arbitrary file upload. The issue arises from an upload mechanism that allows uploading files such as PHP scripts, enabling potential remote code execution on affected dev...
CVE-2018-11523: Unrestricted Upload of File with Dangerous Type
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files...
NUUO NVRmini 2 Arbitrary File Upload Vulnerability
The NUUO NVRmini 2 is a video storage management device from NUUO USA. A security vulnerability exists in the upload.php file in the NUUO NVRmini 2. An attacker can exploit this vulnerability to upload arbitrary files e.g., .php files...
Design/Logic Flaw
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-8766
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-8766
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-8766: Unrestricted Upload of File with Dangerous Type
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-6944
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
CVE-2018-6943
The CVE-2018-6943 entry concerns the WordPress UltimateMember plugin (v2.0) where core/lib/upload/um-image-upload.php is vulnerable to cross-site scripting due to improper sanitization of input assigned to the $temp variable. This XSS condition is documented across multiple sources (NVD listing a...
CVE-2018-6943
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
CVE-2018-6944: Improper Neutralization of Input During Web Page Generation
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
CVE-2018-6943: Improper Neutralization of Input During Web Page Generation
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...