8688 matches found
Big File Uploads < 2.1.2 - Cross-Site Request Forgery via actions
Description The Big File Uploads plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the actions function. This makes it possible for unauthenticated attackers to dismiss or delay admin...
Olive One Click Demo Import <= 1.0.9 - Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file
Description The Olive One Click Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the oliveoneclickdemoimportsavefile function in versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...
CVE-2023-47792
Cross-Site Request Forgery CSRF vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin = 2.1.1 versions...
CVE-2023-47792
Cross-Site Request Forgery CSRF vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin = 2.1.1 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin = 2.1.1 versions...
CVE-2023-47792
CVE-2023-47792 is a CSRF vulnerability in the WordPress plugin Infinite Uploads Big File Uploads – Increase Maximum File Upload Size (versions ≤ 2.1.1). The issue is due to insufficient CSRF protections on actions, enabling unauthenticated exploitation to trigger state-changing requests. CVSS v3....
CVE-2023-47792 WordPress Big File Uploads Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin = 2.1.1 versions...
CVE-2023-47314
Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting XSS. The file upload function allows APK and arbitrary files to be uploaded. By exploiting this issue, attackers may upload HTML files and share the download URL pointing to these files with the victims. As the file download...
CVE-2023-5822 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnduploadcf7upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to...
PT-2023-30613 · WordPress · Infinite Uploads Big File Uploads – Increase Maximum File Upload Size
Name of the Vulnerable Software and Affected Versions: Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin versions = 2.1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user...
Headwind MDM Cross-Site Scripting Vulnerability
Headwind MDM is a platform for managing Android devices in an organization. A cross-site scripting vulnerability exists in Headwind MDM Web panel version 5.22.1, which stems from unrestricted file uploads...
WordPress Plugin Big File Uploads Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Big File Uploads - Increas...
PT-2023-30910 · Unknown · Statamic Cms
Name of the Vulnerable Software and Affected Versions: Statamic CMS versions prior to 3.4.15 and 4.36.0 Description: The issue allows HTML files crafted to look like images to be uploaded, bypassing mime validation. This is applicable on front-end forms using the "Forms" feature with an assets...
Statamic Cross-Site Scripting Vulnerability
Statamic is a powerful flat file Cms built on Laravel by Statamic, Inc. for storing all content, templates, assets, and settings in files instead of a database. A cross-site scripting vulnerability exists in Statamic prior to 3.4.15 and versions prior to 4.36.0, which can be exploited to upload...
Multiple vulnerabilities in EXPRESSCLUSTER X
Overview WebManager/Cluster WebUI of EXPRESSCLUSTER X provided by NEC Corporation contains multiple vulnerabilities listed below. Missing authorization CWE-862 - CVE-2023-39544 Files or directories accessible to external parties CWE-552 - CVE-2023-39545 Use of password hash instead of password fo...
DevBlog 跨站脚本漏洞
DevBlog is a blogging project developed using Node.js Express and MongoDB by Arman Idrisi, an individual developer. A cross-site scripting vulnerability exists in DevBlog v1.0, which stems from the application's lack of valid validation of uploaded files and can be exploited by an attacker to...
CVE-2023-6187 Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload
The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpropaypalexpresssessionvarsforuserfields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber...
PT-2023-32556 · WordPress · Paid Memberships Pro
Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro plugin for WordPress versions up to, and including, 2.12.3 Description: The issue arises from insufficient file type validation in the pmpro paypalexpress session vars for user fields function. This allows authenticated...