14805 matches found
WordPress is vulnerable to Arbitrary File Upload
Software WordPress Type WordPress Core Vulnerable versions 6.4.3 Fixed in 6.4.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2018-14028 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 87a72ffd6c73 Credits Vinicius Marangoni Required privilege...
Contact Form Entries < 1.3.3 - Admin+ Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to insufficient file validation on the 'viewpage' function, allowing authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code...
WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload
Software Icons Font Loader Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-24714 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 8add145a8567 Credits Vulzap Required privilege Administrator...
WordPress Contact Form Entries Plugin <= 1.3.2 is vulnerable to Arbitrary File Upload
Software Contact Form Entries Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-1069 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 192b96d23fe0 Credits István Márton Required privilege...
WordPress plugin Contact Form Entries Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...
Avada < 7.11.2 - Contributor+ Arbitrary File Upload
Description The theme is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaximportoptions' function, making it possible for authenticated attackers with contributor permissions to upload arbitrary files on the affected site's server which may make remote code...
YonBIP File Upload Vulnerability in UFIDA Network Technology Co.
YonBIP is a new generation of products developed by UFIDA, as the world's leading enterprise digital intelligence platform and application software. A file upload vulnerability exists in YonBIP, which can be exploited by an attacker to upload arbitrary files and execute arbitrary code in the...
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Description The theme is vulnerable to arbitrary file uploads due to missing file type validation when extracting zip files in the 'processupload' and 'regenerateiconfiles' functions. This makes it possible for authenticated attackers with author permissions to upload arbitrary files on the...
Progress WS_FTP Server < 8.7.6, 8.8.x < 8.8.4 Arbitrary File Upload
The remote host is running a version of WSFTP earlier than 8.7.6 or 8.8.x prior to 8.8.4. It is, therefore, affected by an arbitrary file upload vulnerability in the Ad Hoc Transfer Mode module. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload...
Thruk Path Traversal Vulnerability
Thruk is an open source multi-backend monitoring web interface from the individual developer Sven Nierlein in Germany. A path traversal vulnerability exists in versions prior to Thruk 3.12, which stems from a vulnerability that allows an attacker to arbitrarily upload files to any path on the...
LeptonCMS Arbitrary File Upload Vulnerability
LeptonCMS is a content management system CMS for the Lepton Project. An arbitrary file upload vulnerability exists in LeptonCMS version v7.0.0, which stems from the application's lack of effective authentication of uploaded files. An authenticated attacker can exploit this vulnerability to execut...
PT-2024-19964 · Unknown · Parisneo/Lollms-Webui
Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: A vulnerability in parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. The issue resides in the install...
CVE-2024-22550
An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...
CVE-2024-22550
An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...
Privilege escalation
An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...
PT-2024-19483 · Shopsite · Shopsite
Name of the Vulnerable Software and Affected Versions: ShopSite version 14.0 Description: An arbitrary file upload issue in the /alsdemo/ss/mediam.cgi component allows attackers to execute arbitrary code by uploading a crafted SVG file. Recommendations: For ShopSite version 14.0, consider disabli...
CVE-2024-22550
CVE-2024-22550 concerns ShopSite v14.0, where the vulnerable component is the /alsdemo/ss/mediam.cgi module. The issue is an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code by uploading a crafted SVG file. According to the sources, the vulnerability affects S...
ShopSite Security Breach
ShopSite is an online store from ShopSite Inc. A security vulnerability exists in ShopSite v14.0, which stems from an arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi that allows an attacker to execute arbitrary code by uploading a specially crafted SVG file...
