Beijing Baichuo Smart S42 Management Platform Code Issue Vulnerability

Beijing Baichuo Smart S42 is an Internet Behavior Management appliance from Beijing Baichuo, China. A code issue exists in Beijing Baichuo Smart S42 Management Platform 20240219 and prior versions, which originates from an unknown function in /useratte/userattestation.php that causes unrestricted...

CVE-2024-1710

The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

Complaint Management System Code Issue Vulnerability

Complaint Management System is a complaint management system by the individual developer Arvin Arandilla. A code issue vulnerability exists in version 1.0 of Complaint Management System, which stems from unrestricted file uploads...

WordPress Plugin Moveto Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

WordPress Plugin Icons Font Loader Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2024-18241 · WordPress · Addon Library

Name of the Vulnerable Software and Affected Versions: Addon Library plugin for WordPress versions up to, and including, 1.3.76 Description: The issue is related to a missing capability check on the onAjaxAction function action, allowing authenticated attackers with subscriber-level access and...

Brizy – Page Builder < 2.4.41 - Authenticated (Contributor+) Arbitrary File Upload

Description The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated attackers, with contributor access or above, to...

CodeAstro Membership Management System Security Vulnerability

CodeAstro Membership Management System is a membership management system from CodeAstro. A security vulnerability exists in CodeAstro Membership Management System version 1.0, which stems from a parameter Member Photo in the component Add Members Tab that can lead to unrestricted uploads...

PT-2024-18333 · Unknown · Codeastro Membership Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Membership Management System version 1.0 Description: A critical issue was found in the Logo Handler component, specifically affecting some unknown functionality of the file /uploads/. This issue leads to unrestricted upload. The...

CodeAstro Membership Management System Code Issue Vulnerability

CodeAstro Membership Management System is a membership management system from CodeAstro. A code issue vulnerability exists in CodeAstro Membership Management System version 1.0, which stems from the component Logo Handler's file /uploads/ that can lead to unrestricted uploads...

Apache Answer 代码问题漏洞

Apache Answer is a community platform of the Apache USA Foundation. A denial of service vulnerability exists in Apache Answer 1.2.1 and earlier versions, which can be exploited by attackers to conduct pixel flooding attacks by uploading large pixelated files, resulting in a server out of memory...

IBM Trusteer Code Issue Vulnerability

IBM Trusteer is a suite of security solutions from International Business Machines IBM focused on providing security tools for cybercrime prevention and end-user protection. IBM Trusteer has a code issue vulnerability that stems from the presence of certain undisclosed issues that could allow fil...

CVE-2023-52154

File Upload vulnerability in pmb/cameraupload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files...

PT-2024-21400 · Kirby Cms · Kirby Cms

Name of the Vulnerable Software and Affected Versions: Kirby CMS version 4.1.0 Description: The issue is related to an arbitrary file upload vulnerability in the Profile Image module, allowing attackers to execute arbitrary code via a crafted PDF file. This vulnerability affects all Kirby sites...

Cross-site scripting (XSS) in the dynamic file uploads

Impact The dynamic file upload feature is subject to potential XSS attach in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to chang...

GHSA-9W99-78RJ-HMXQ Cross-site scripting (XSS) in the dynamic file uploads

Impact The dynamic file upload feature is subject to potential XSS attach in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to chang...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dynamic file upload feature. An attacker can modify the file names of the records being uploaded to the server, which could lead to the execution of malicious scripts. This vulnerability is present in...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dynamic file upload feature. An attacker can modify the file names of the records being uploaded to the server, which could lead to the execution of malicious scripts. This vulnerability is present in...

CVE-2023-51447 Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads

Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the serve...

CVE-2023-51447 Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads

Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the serve...