CVE-2024-35527

An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file...

CVE-2024-5008

In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController...

CVE-2024-35527

FarCry Core framework (Daemon PTY Limited) vulnerable to arbitrary code execution via fileupload/upload.cfm in versions prior to 7.2.14. The flaw allows uploading a crafted .cfm file to achieve remote code execution. Impact is asserted as high (C, I, A) with CVSS v3.1 base score 9.8. Affected pro...

CVE-2024-35527

An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file...

Progress Software WhatsUp Gold Security Vulnerability

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. A security vulnerability exists in Progress Software WhatsUp Gold version 2023.1.3 that...

CVE-2024-35527

An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file...

CVE-2024-37228 WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through = 0.1.0.38...

CVE-2024-37228 WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in InstaWP Team InstaWP Connect allows Code Injection.This issue affects InstaWP Connect: from n/a through 0.1.0.38...

CVE-2024-24550

CVE-2024-24550 impacts Bludit via the File API, where an attacker with knowledge of the API token can upload arbitrary files, leading to arbitrary code execution on the server. The root cause is improper handling of file uploads, enabling PHP file uploads and execution. Affected software is Bludi...

Edu-Sharing Arbitrary File Upload

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Arbitrary File Upload product: edu-sharing metaVentis GmbH vulnerable versions: =8.0.8-RC2, =8.1.4-RC0, =9.0.0-RC19 CVE number: CVE-2024-28147 impact: high homepage:...

CVE-2024-35767 WordPress Squeeze plugin <= 1.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This issue affects Squeeze: from n/a through 1.4...

CVE-2024-35767 WordPress Squeeze plugin <= 1.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This issue affects Squeeze: from n/a through 1.4...

WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by AtaTurk1925 Patchstack Alliance in WordPress Plugin InstaWP Connect versions = 0.1.0.38...

WordPress InstaWP Connect Plugin <= 0.1.0.38 is vulnerable to Arbitrary File Upload

Software InstaWP Connect Type Plugin Vulnerable versions = 0.1.0.38 Fixed in 0.1.0.39 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2024-37228 Patch priority High CVSS severity High 10 Developer InstaWP PSID de870abeda47 Credits AtaTurk1925 Required privilege...

edu-sharing Permission and Access Control Issues Vulnerability

edu-sharing is an open source e-learning integration solution from edu-sharing, Inc. A security vulnerability exists in edu-sharing that stems from allowing the upload of arbitrary files...

WordPress Pexels: Free Stock Photos plugin <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Pexels: Free Stock Photos versions = 1.2.2...

CVE-2024-5853

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirvuploadfilebychanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with...

CVE-2024-5853

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirvuploadfilebychanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with...

CVE-2024-6132

CVE-2024-6132 affects Pexels: Free Stock Photos, a WordPress plugin vulnerable to arbitrary file upload due to missing file type validation in pexels_fsp_images_options_validate. Versions up to and including 1.2.2 are affected. Exploitation requires authenticated access at contributor level or hi...

CVE-2024-5853 Image Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirvuploadfilebychanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with...