14855 matches found
MicroEngine Mailform 代码问题漏洞
MicroEngine Mailform is a PHP mail form from MicroEngine Japan. A security vulnerability exists in MicroEngine Mailform versions 1.1.0 through 1.1.8, which stems from an unrestricted upload of a dangerous type of file, and allows a remote attacker to save an arbitrary file on the server and execu...
CVE-2023-31689
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...
Revolution Slider <= 6.6.12 - Author+ Remote Code Execution
The plugin does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations. By default, the import functionality is only available to Admin users. However, the plugin may be configured to allow...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.
The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...
WCMS 代码问题漏洞
WCMS is a content management system CMS. A security vulnerability exists in WCMS version 0.3.2. An attacker can use this vulnerability to write arbitrary strings to custom file names and upload arbitrary files, or write malicious code to execute scripts to trigger command execution...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.
The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...
CVE-2023-31689
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...
WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload
Software WooCommerce Follow-Up Emails Type Plugin Vulnerable versions = 4.9.40 Fixed in 4.9.50 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-33318 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID c6e0ffcab096 Credits Rafie Muhammad...
Simple Photo Gallery Arbitrary File Upload Vulnerability
Simple Photo Gallery is a simple gallery web application. An arbitrary file upload vulnerability exists in Simple Photo Gallery v1.0, which stems from the application's lack of validation of uploaded files. The vulnerability can be exploited to remotely execute arbitrary code by uploading malicio...
Privilege escalation
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file...
PerfreeBlog 代码问题漏洞
PerfreeBlog is a java-based blog/CMS builder. A security vulnerability exists in PerfreeBlog version v3.1.2, which stems from the presence of an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code via a crafted file...
Online Computer and Laptop Store Arbitrary File Upload Vulnerability (CNVD-2023-40599)
Online Computer and Laptop Store is an online computer and laptop store. An arbitrary file upload vulnerability exists in Online Computer and Laptop Store v1.0, which stems from a failure to restrict file uploads at /classes/Users.php?f=save, and can be exploited by an attacker to cause remote co...
CVE-2023-30333
CVE-2023-30333 affects PerfreeBlog v3.1.2. The arbitrary file upload vulnerability is in the /admin/ThemeController.java component and can lead to remote code execution via a crafted file. CVSS v3.1 base score 9.8 (CRITICAL) with network access, no privileges, and no user interaction required. Do...
CVE-2023-30333
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file...
PT-2023-22640 · Unknown · Perfreeblog
Name of the Vulnerable Software and Affected Versions: PerfreeBlog version 3.1.2 Description: An arbitrary file upload issue in the /admin/ThemeController.java component allows attackers to execute arbitrary code via a crafted file. Recommendations: For PerfreeBlog version 3.1.2, consider...
CVE-2023-30333
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file...
Simple Photo Gallery 代码问题漏洞
Simple Photo Gallery is a simple gallery web application. An arbitrary file upload vulnerability exists in Simple Photo Gallery v1.0, which stems from the application's lack of validation of uploaded files. The vulnerability can be exploited to remotely execute arbitrary code by uploading malicio...
CVE-2023-32986
Jenkins File Parameter Plugin 285.v757c5b67ac25 and earlier does not restrict the name and resulting uploaded file name of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified...