PT-2015-7032

Name of the Vulnerable Software and Affected Versions Powerplay Gallery plugin version 3.3 for WordPress Description The issue concerns an unrestricted file upload vulnerability. This allows remote attackers to execute arbitrary code by uploading a file with an executable extension and then...

WordPress dzs-zoomsounds Plugins <= 2.0 - Remote File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability Vendor : http://digitalzoomstudio.net/docs/wpzoomsounds/ Author: bl4ck-dz Date: 28/05/2015 Infected File: upload.php Category: webapps Google...

WordPress Plugin dzs-zoomsounds 2.0 - Arbitrary File Upload

Exploit Title: WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability Vendor : http://digitalzoomstudio.net/docs/wpzoomsounds/ Author: bl4ck-dz Date: 28/05/2015 Infected File: upload.php Category: webapps Google dork:inurl:/wp-content/plugins/dzs-zoomsounds/ Tested on : Linux | Windows...

WordPress Amerisale Re Plugin -Reflected XSS

This plugin is prone to a cross site scripting vulnerability in netriesdetail/upload.php edit parameter. Solution Update the plugin...

WordPress Amerisale Re Plugin -Reflected XSS

This plugin is prone to a cross site scripting vulnerability in netriesdetail/upload.php edit parameter. Solution Update the plugin...

WordPress DesignFolio+ Theme File Upload

Exploit Title: Wordpress Theme DesignFolio+ Arbitrary File Upload Vulnerability Google dork: inurl:wp-content/themes/DesignFolio-Plus Author: CrashBandicot Date: 04.03.2015 OSVDB-ID: 119623 Vendor HomePage: https://github.com/UpThemes/DesignFolio-Plus Software Link:...

CVE-2015-2195: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 view, 2 paged, or 3 s parameter in the wp-media-cleaner page to wp-admin/upload.php...

CVE-2014-9567: Improper Control of Generation of Code

Unrestricted file upload vulnerability in process-upload.php in ProjectSend formerly cFTP r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/...

CVE-2014-7835

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

CVE-2014-7835

CVE-2014-7835 affects Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3. The webservice/upload.php handler fails to ensure uploaded files are placed in a private/draft area, allowing remote authenticated users to upload JavaScript in the profile-picture area and perform cross-site scripting (XSS)....

CVE-2014-7835: Improper Neutralization of Input During Web Page Generation

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

CVE-2014-2044

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream ADS syntax in the filename...

CVE-2014-2044: Improper Control of Generation of Code

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream ADS syntax in the filename...

PT-2014-4448

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0 Description The issue allows remote authenticated users to bypass access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream ADS syntax in the filename...

GetSimpleCMS PHP File Upload Exploit

This Metasploit module exploits a file upload vulnerability in GetSimple CMS. By abusing the upload.php file, a malicious authenticated user can upload an arbitrary file, including PHP code, which results in arbitrary code execution. This module requires Metasploit: http//metasploit.com/download...

CVE-2014-2223: Improper Control of Generation of Code

Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a direct request to it i...

Echelon - media-upload.php Remote File Upload

The echelon WordPress theme was affected by a media-upload.php Remote File Upload security vulnerability...

PDW File Browser - upload.php Arbitrary File Upload

The pdw-file-browser WordPress plugin was affected by an upload.php Arbitrary File Upload security vulnerability...

Asset Manager - upload.php Arbitrary Code Execution

The asset-manager WordPress plugin was affected by an upload.php Arbitrary Code Execution security vulnerability...

Smart Slideshow - upload.php Multiple File Extension Upload Arbitrary Code Execution

The smart-slide-show WordPress plugin was affected by an upload.php Multiple File Extension Upload Arbitrary Code Execution security vulnerability...