Python-exploit-CVE-2020-25213

विवरण WordPress के लिए File Manager wp-file-manager प्लगइन संस्करण 6.9 से पहले रिमोट हमलावरों को मनमाना PHP कोड अपलोड और निष्पादित करने की अनुमति देता है, क्योंकि यह एक असुरक्षित उदाहरण elFinder कनेक्टर फ़ाइल का नाम बदलकर .php एक्सटेंशन कर देता है। उदाहरण के लिए, यह हमलावरों को elFinder अपलोड या...

CVE-2026-14560: Improper Control of Generation of Code

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-11962: Undefined Security Weakness

The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and...

EUVD-2018-3755

Malware in sbrugna...

WordPress plugin Catch Themes Demo Import 代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A code issue vulnerability exists in the WordPress plugin Cat...

CVE-2018-19550

Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI...

CVE-2018-18888: Unrestricted Upload of File with Dangerous Type

An issue was discovered in laravelCMS through 2018-04-02. \app\Http\Controllers\Backend\ProfileController.php allows upload of arbitrary PHP files because the file extension is not properly checked and uploaded files are not properly renamed...

CVE-2018-17573: Unrestricted Upload of File with Dangerous Type

The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and...

CVE-2008-1866: Improper Control of Generation of Code

admin/modifconfig.php in Blog Pixel Motion aka PixelMotion does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct...