14851 matches found
CVE-2022-4949
The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaxupload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on th...
CVE-2022-4949
The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaxupload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on th...
CVE-2023-33601
An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2021-4354
The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwpsplashscreenuploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites...
CVE-2020-36701
The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'processbulkaction' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level...
CVE-2020-36701
The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'processbulkaction' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level...
CVE-2016-15033
The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...
Input validation
The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwpsplashscreenuploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites...
Input validation
The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetchexternalimage function in versions up to, and including, 3.0.4. This makes it possible for authenticated attackers to upload arbitrary files on the affected site's server whic...
Design/Logic Flaw
An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2021-4382
The CVE-2021-4382 entry concerns the Recently plugin for WordPress. Affected component: fetch_external_image() in versions up to and including 3.0.4. Root cause: missing file type validation enables authenticated attackers to upload arbitrary files to the server. Impact: arbitrary file uploads wi...
CVE-2016-15033 Delete All Comments <= 2.0 - Arbitrary File Upload
The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...
CVE-2019-25138 User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload
The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uspcheckimages function in versions up to, and including, 20190312. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...
CVE-2021-4354 PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload
The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwpsplashscreenuploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites...
CVE-2021-4354 PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload
The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwpsplashscreenuploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites...
CVE-2021-4354
The CVE-2021-4354 entry concerns the WordPress plugin PWA for WP & AMP. Affected: PWA for WP & AMP for WordPress, pwaforwp_splashscreen_uploader in versions up to 1.7.32. Root cause: missing file type validation allows authenticated users to upload arbitrary files on the server, with potential fo...
CVE-2020-36701
CVE-2020-36701 concerns the WordPress plugin Page Builder: KingComposer . The vulnerability is Arbitrary File Upload via the function process_bulk_action in kingcomposer/includes/kc.extensions.php , affecting versions up to and including 2.9.3 . authenticated users with author+ permissions can up...
PT-2023-24402 · Phpok · Phpok
Name of the Vulnerable Software and Affected Versions: phpok version 6.4.100 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the "/admin.php?c=upload" API endpoint, specifically the c parameter set to...
CVE-2023-33601
CVE-2023-33601 describes an arbitrary file upload vulnerability in the PHPok web application (version 6.4.100). The flaw resides in the /admin.php?c=upload endpoint, allowing an attacker to upload a crafted PHP file to achieve arbitrary code execution. The provided connected documents confirm the...