CVE-2024-7484 CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload

The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handleuploadedfiles' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to...

CVE-2024-7484

CVE-2024-7484 affects the CRM Perks Forms – WordPress Form Builder plugin. The vulnerability is an arbitrary file upload due to insufficient validation in the handle_uploaded_files function across versions up to 1.1.3. With authenticated admin+ privileges, an attacker could upload arbitrary files...

WordPress Blox Page Builder Plugin <= 1.0.65 is vulnerable to Arbitrary File Upload

Software Blox Page Builder Type Plugin Vulnerable versions = 1.0.65 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6315 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID ffdf8c3e90d1 Credits István Márton Required privilege...

PT-2024-38375 · WordPress · Crm Perks Forms

Name of the Vulnerable Software and Affected Versions: CRM Perks Forms plugin for WordPress versions up to, and including, 1.1.3 Description: The issue is related to arbitrary file uploads due to insufficient file validation on the handle uploaded files function. This allows authenticated attacke...

WordPress CRM Perks Forms plugin <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload vulnerability

Authenticated Administrator+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin CRM Perks Forms versions = 1.1.3...

WordPress CRM Perks Forms Plugin <= 1.1.3 is vulnerable to Arbitrary File Upload

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7484 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID c7c64ee12633 Credits István Márton Required privilege...

Clariti Manager - Arbitrary File Upload

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize user input. The recommendation is to update an impacted device to firmware build 10.12.0.2100 or later. Customers can receive the latest builds throu...

WordPress YayExtra Plugin <= 1.3.7 is vulnerable to Arbitrary File Upload

Software YayExtra Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7257 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 6980efb16c4d Credits wesley wcraft Required privilege Unauthenticated...

CVE-2024-7257

The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handleuploadfile function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary...

CVE-2024-7257 YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function

The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handleuploadfile function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary...

PT-2024-38214 · WordPress · Yayextra – Woocommerce Extra Product Options

Name of the Vulnerable Software and Affected Versions: YayExtra – WooCommerce Extra Product Options plugin for WordPress versions up to, and including, 1.3.7 Description: The issue is related to arbitrary file uploads due to missing file type validation in the handle upload file function. This...

Path traversal in Reposilite javadoc file expansion (arbitrary file creation/overwrite) (`GHSL-2024-073`)

Summary Reposilite v3.5.10 is affected by an Arbitrary File Upload vulnerability via path traversal in expanding of Javadoc archives. Details Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller...

GHSA-FRVJ-CFQ4-3228 Path traversal in Reposilite javadoc file expansion (arbitrary file creation/overwrite) (`GHSL-2024-073`)

Summary Reposilite v3.5.10 is affected by an Arbitrary File Upload vulnerability via path traversal in expanding of Javadoc archives. Details Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller...

AccPack Buzz 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : AccPack Buzz v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...

The vulnerability of Zyxel network device microprogramming software, related to deficiencies in access control, allows attackers to enhance their privileges and upload arbitrary configuration files.

The vulnerability of Zyxel network device microprogramming software is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges and upload arbitrary configuration files...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

WonderCMS 安全漏洞

WonderCMS is an open source PHP-based content management system CMS from WonderCMS Inc. A security vulnerability exists in WonderCMS version 3.4.3, which stems from an arbitrary file upload vulnerability in the uploadFileAction function, allowing an attacker to execute arbitrary code via a crafte...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

WordPress Business Card Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software Business Card Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2024-5807 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID a6a458d61852 Credits Anjo Rev Tingson Required privilege...