CVE-2024-52581

CVE-2024-52581 affects Litestar (ASGI framework). The vulnerability arises in the multipart/form-data parsing path prior to version 2.13.0, where the parser reads the entire request body into memory without a size limit, enabling unbounded memory consumption (DoS) on large uploads. The issue is t...

WordPress HB AUDIO GALLERY plugin <= 3.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin HB AUDIO GALLERY versions = 3.0...

WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Verbalize WP versions = 1.0...

WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin WP Dropbox Dropins versions = 1.0...

WordPress Creates 3D Flipbook, PDF Flipbook plugin <= 1.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Creates 3D Flipbook, PDF Flipbook versions = 1.2...

WordPress Jupiter X Core plugin <= 4.6.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Geo Void in WordPress Plugin JupiterX Core versions = 4.6.5...

CVE-2024-8940 Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase

Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jqueryplugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly...

WordPress Depicter Slider plugin <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Depicter Slider versions = 3.1.1...

CVE-2024-40318

An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-40548

PublicCMS 4.0.202302.e contains an arbitrary file upload flaw in /admin/cmsTemplate/save that can lead to arbitrary code execution when a crafted file is uploaded. The CVSSv3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and require low privileges. Exploitation status is ...

PT-2024-26551 · Inxedu · Inxedu

Name of the Vulnerable Software and Affected Versions: inxedu version 2.0.6 Description: The issue is related to an arbitrary file upload vulnerability in the ImageUploadController.class component. This allows attackers to execute arbitrary code by uploading a crafted jsp file. Recommendations: F...

CVE-2024-2361 Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui

A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the installmodel function within lollmscore/lollms/binding.py, where the application fails to properly sanitize the...

Roothub 安全漏洞

Roothub is a forum system developed using SSM and MySQL. A security vulnerability exists in Roothub v2.5, which originates from an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code via a crafted JSP file...

WordPress All-in-One Video Gallery plugin <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image vulnerability

Authenticated Contributor+ Arbitrary File Upload via featured image vulnerability discovered by stealthcopter in WordPress Plugin All-in-One Video Gallery versions = 3.6.4...

WordPress Plugin Everest Backup 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Design/Logic Flaw

A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary locations on the server on which the application is installed...

PT-2024-20243 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 4.3.0-RC1 and prior Description: An arbitrary File upload vulnerability exists in the uploadImg function of SysUserController at com.java2nb.system.controller.SysUserController. This allows an attacker to pass in a special...

jshERP Security Vulnerabilities

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. A security vulnerability exists in jshERP v3.3. The vulnerability stems from the fact that the jshERP-boot/systemConfig/upload interface does not check the uploaded file type and can splice biz...

WordPress Plugin Drag and Drop Multiple File Upload - Contact Form 7 Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Drag and Drop Multiple Fil...

Beijing Baichuo Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Code Issue Vulnerability

Beijing Baichuo Smart S45F Multi-Service Secure Gateway Intelligent Management Platform is a Multi-Service Secure Gateway Intelligent Management Platform from Beijing Baichuo, China. Byzro Networks Smart S45F Multi-Service Secure Gateway Intelligent Management Platform 20230928 and earlier versio...