Python-exploit-CVE-2020-25213

설명 WordPress용 File Managerwp-file-manager 플러그인 6.9 이전 버전은 안전하지 않은 예제 elFinder 커넥터 파일의 이름을 .php 확장자로 변경하므로 원격 공격자가 임의의 PHP 코드를 업로드하고 실행할 수 있습니다. 예를 들어, 공격자는 elFinder upload 또는 mkfile 및 put 명령을 실행하여 PHP 코드를 wp-content/plugins/wp-file-manager/lib/files/ 디렉터리에 작성할 수 있습니다. 이 취약점은 2020년 8월과 9월에 실제 환경에서...

CVE-2026-14560: Improper Control of Generation of Code

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-11962: Undefined Security Weakness

The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and...

EUVD-2018-3755

Malware in sbrugna...

WordPress plugin Catch Themes Demo Import 代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A code issue vulnerability exists in the WordPress plugin Cat...

CVE-2018-19550

Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI...

CVE-2018-18888: Unrestricted Upload of File with Dangerous Type

An issue was discovered in laravelCMS through 2018-04-02. \app\Http\Controllers\Backend\ProfileController.php allows upload of arbitrary PHP files because the file extension is not properly checked and uploaded files are not properly renamed...

CVE-2018-17573: Unrestricted Upload of File with Dangerous Type

The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and...

CVE-2008-1866: Improper Control of Generation of Code

admin/modifconfig.php in Blog Pixel Motion aka PixelMotion does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct...