CVE-2025-2031

A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...

Malicious code in @kamotive/api-file-upload (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-26433 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml versions up to 0.2.5 Description: A vulnerability was found in libyaml, affecting the function yaml event delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free. Recommendations: For libyaml versions up to...

PT-2024-18425 · Sourcecodester · Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical issue was found in the function delete class/delete student of the file /ajax-api.php of the component List of Classes Page. The manipulation of the argument ...

PT-2024-1293

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 6.7.1 Description The issue is related to a use-after-free in the cec queue msg fh function, which is associated with the files cec-adap.c and cec-api.c in the drivers/media/cec/core directory. This problem is als...

PT-2023-27178 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions 1.4.3 Description: An arbitrary file write vulnerability could lead to direct control of the server. In the api/v1/file.go file, there is a function called SaveContentthat,It that receives JSON data sent by users in the form o...

PT-2023-16986 · Meizhou Qingyunke · Qykcms

Name of the Vulnerable Software and Affected Versions: Meizhou Qingyunke QYKCMS version 4.3.0 Description: A vulnerability was found in the Update Handler component of Meizhou Qingyunke QYKCMS, affecting an unknown part of the file /admin system/api.php. The manipulation of the downurl argument...

CVE-2022-3939 lanyulei ferry API file.go path traversal

A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/public/file.go of the component API. The manipulation of the argument file leads to path traversal. The attack may be launched remotely...

Out-of-bounds

A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...

GHSA-6CWV-WJ7V-73XP Magento executes code via the API File Option Upload Extension

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

PT-2022-37716

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

PT-2022-16287

Name of the Vulnerable Software and Affected Versions Sidekiq versions prior to 5.2.10 Sidekiq versions prior to 6.4.0 Description The issue arises from the lack of a limit on the number of days when requesting stats for the graph in api.rb in Sidekiq. This leads to an overload of the system,...

CVE-2021-36042

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

CVE-2021-36042 Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

PT-2021-6369

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier Magento Commerce version 2.3.7 and earlier Description The issue is caused by improper input validation in the API File Option Upload Extension. An attacker with Admin privilege...

Dell EMC PowerScale OneFS elevation of privilege vulnerability (CNVD-2021-13938)

Dell EMC PowerScale OneFS is an API-powered file system. An elevation of privilege vulnerability exists in Dell EMC PowerScale OneFS 8.1.0 - 9.1.0. An attacker with the ISIPRIVJOBENGINE privilege could exploit this vulnerability by using a PermissionRepair job to grant themselves the highest leve...

PhpOK SQL Injection Vulnerability

phpok is a set of enterprise website system developed by Shenzhen锟絪 technology limited company using PHP+MYSQL language. PhpOK 5.4.137 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by injecting attachment data via SQL and then calling the attachment...

WordPress wp-google-maps plugin input validation error vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-maps plugin is a Google Maps plugin used in it. An input validation error vulnerability exists in the...

PT-2017-3601

Name of the Vulnerable Software and Affected Versions: ClipBucket versions prior to 4.0.0 Release 4902 Description: The issue is related to the lack of proper neutralization of special elements used in OS commands. This allows an attacker to inject any OS commands via shell metacharacters in the...

PHPAPP网站应用系统SQL注入1

简要描述： PHPAPP 全球领先的网站应用系统。 PHPAPP 全球网站应用的开创者,独创系统核心长期提供丰富网站应用程序,专为站长企业打造盈利应用。 详细说明： 第一个漏洞： PHPAPP网站应用系统官方最新版SQL注入 程序官网：http://www.phpapp.cn/index.html 在文件/api/chinabank/receive.php中： SetPayMoney$void,$vamount,'ChinaBank'; else $pay-PayError; else $pay-PayError; ? 从上面看出：...