CVE-2024-24000

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths...

CVE-2024-24000

CVE-2024-24000 affects jshERP v3.3. The vulnerability arises in the jshERP-boot/systemConfig/upload endpoint, which does not validate the uploaded file type and allows the biz parameter to be spliced into the upload path, enabling arbitrary file uploads with controllable paths. Reported impact is...

CVE-2024-24000

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths...

WordPress AI Engine: ChatGPT Chatbot Plugin <= 2.1.4 is vulnerable to Arbitrary File Upload

Software AI Engine: ChatGPT Chatbot Type Plugin Vulnerable versions = 2.1.4 Fixed in 2.1.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-0699 Patch priority Medium CVSS severity Medium 6.6 Developer Claim ownership PSID a07cf1730f82 Credits rootxsudip Required...

iSpyConnect.com Agent DVR Security Vulnerability

iSpyConnect.com Agent DVR is a cross-platform video surveillance software. A security vulnerability exists in iSpyConnect.com Agent DVR version 5.1.6.0. An attacker can exploit the vulnerability to upload arbitrary files via the upload audio component...

PT-2024-20226 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns an Arbitrary File Upload vulnerability. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulti...

CVE-2024-24000

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths...

CVE-2024-22515

Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio component...

WordPress Gutenberg Block Editor Toolkit Plugin <= 1.40.3 is vulnerable to Arbitrary File Upload

Software Gutenberg Block Editor Toolkit Type Plugin Vulnerable versions = 1.40.3 Fixed in 1.40.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6635 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID d39ac6b70847 Credits István Márton Required...

CVE-2023-6925

The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authenticated attackers with a role that the...

CVE-2023-6846

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server...

CVE-2023-6846

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server...

Design/Logic Flaw

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server...

Input validation

The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authenticated attackers with a role that the...

CVE-2023-6846 File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server...

CVE-2023-6846 File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server...

CVE-2023-6846

The File Manager Pro WordPress plugin (wp-file-manager-pro) is vulnerable to Arbitrary File Upload in versions up to and including 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. Authenticated users with subscriber access can cause server-side code execution. Version 8.3.5 adds a cap...

CVE-2023-6925 Unlimited Addons for WPBakery Page Builder <= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload

The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authenticated attackers with a role that the...

CVE-2023-6635

The CVE-2023-6635 entry concerns the WordPress EditorsKit plugin. Affected component: the import_styles function. Root cause: missing file type validation allows an authenticated administrator to upload arbitrary files to the site server, potentially enabling remote code execution. Affected versi...

WordPress plguin EditorsKit Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...