CVE-2022-24652: Unrestricted Upload of File with Dangerous Type

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload...

PT-2022-16775

Name of the Vulnerable Software and Affected Versions sentcms versions 4.0.x Description The issue allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution in the /admin/upload/upload endpoint. Recommendations For sentc...

Tensent SentCMS code-related vulnerabilities

Tensent SentCMS is a simple and easy-to-use website management system from Tensent, China. A security vulnerability exists in Tensent SentCMS version 4.0.x. The vulnerability stems from a lack of validation of uploaded files in the file upload interface of the /admin/upload/upload php code in the...

CVE-2021-27984

In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files...

CVE-2020-23572

BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file...

BEESCMS code-related vulnerabilities

BEESCMS is a template program completely separated, using PHP MYSQL technology development, with powerful SEO features, simple operation of the self-service building system. BEESCMS version 4.0 /admin/upload.php in the arbitrary file upload vulnerability. The vulnerability can be exploited by...

CVE-2020-20672

An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file...

CVE-2021-24620

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could...

PT-2021-10529

Name of the Vulnerable Software and Affected Versions: KiteCMS version 1.1 Description: An arbitrary file upload vulnerability in the "/admin/upload/uploadfile" API endpoint of KiteCMS allows attackers to upload a crafted PHP file, potentially leading to unauthorized access. Recommendations: For...

CVE-2020-20672: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file...

KiteCMS code-related vulnerabilities

KiteCMS is a content management system based on think php. An arbitrary file upload vulnerability exists in /admin/upload/uploadfile in KiteCMS version 1.1. An attacker can exploit the vulnerability getshell via a specially crafted PHP file...

CVE-2020-18886

Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/uploadfiledo.php'...

PT-2021-10250

Name of the Vulnerable Software and Affected Versions: PHPMyWind version 5.6 Description: The issue allows remote attackers to execute arbitrary code. This is achieved via the component 'admin/upload file do.php', which is vulnerable to unrestricted file upload. Recommendations: For PHPMyWind...

CVE-2021-28977

Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...

Remote code execution

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...

CVE-2021-28976

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...

GetSimpleCMS cross-site scripting vulnerability

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/upload.php in GetSimple CMS version 3.3.16. The vulnerability can be exploited to conduct cross-site scripting attacks by adding comments to the...

CVE-2021-27489

ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file. This file could allow an attacker to remotely execute arbitrary commands...

WordPress code issues and vulnerabilities

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin Event Banner version 1.3 and prior versions...

CVE-2020-29471: Improper Neutralization of Input During Web Page Generation

OpenCart 3.0.3.6 is affected by cross-site scripting XSS in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger...