15460 matches found
Online Food Ordering System 代码问题漏洞
Online Food Ordering System is an online food ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Food Ordering System version v2.0, which originates from an arbitrary file upload vulnerability in the component /fos/admin/ajax.php, which can be...
WordPress plugin Enable Media Replace 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...
PT-2023-16115 · WordPress · Enable Media Replace
Name of the Vulnerable Software and Affected Versions: Enable Media Replace WordPress plugin versions prior to 4.0.2 Description: The issue allows authors to upload arbitrary files to the site, potentially enabling them to upload PHP shells on affected sites. Recommendations: For Enable Media...
WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server PoC 1. Install and activate woocommerce dependency, no setup required 2. Install and active the vulnerable plugin n-media-woocommerce-checkout-fields...
CVE-2023-24646
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file...
WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server 1. Install and activate woocommerce dependency, no setup required 2. Install and active the vulnerable plugin n-media-woocommerce-checkout-fields 17.2...
CVE-2023-24646
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2023-24646
CVE-2023-24646 affects Food Ordering System v2.0; the vulnerability is an arbitrary file upload via /fos/admin/ajax.php that can lead to arbitrary code execution. The CVSS v3.1 base score is 9.8 (CRITICAL) with network access, no authentication, and high impact on confidentiality, integrity, and ...
Exploit for CVE-2022-0316
Wordpress Multiple themes - Unauthenticated Arbitrary File Upl...
The vulnerability of the mDNSResponder.exe executable software used for configuring and managing Dante-enabled Zoom Rooms allows a attacker to load arbitrary files.
The vulnerability of software for configuring and managing Dante-enabled Zoom Rooms relates to incorrect handling of the search path. Exploiting this vulnerability could allow a malicious actor to upload arbitrary files remotely...
PT-2023-3789 · NetGear · Netgear Prosafe Network Management System
Name of the Vulnerable Software and Affected Versions: NETGEAR ProSAFE Network Management System affected versions not specified Description: The issue is related to the lack of proper validation of user-supplied data in the MFileUploadController class, allowing the upload of arbitrary files. Thi...
CVE-2023-22735
CVE-2023-22735 affects Zulip: prior to commit 2f6c5a8 but after 04cf68b, files uploaded with arbitrary Content-Type could be served from the Zulip hostname with Content-Disposition: inline and without a Content-Security-Policy header, enabling execution of arbitrary JavaScript in the Zulip contex...
CVE-2022-21587: Rapid7 Observed Exploitation of Oracle E-Business Suite Vulnerability
Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. Rapid7 is responding to various compromises arising from the exploitation of CVE-2022-21587, a critical arbitrary file upload vulnerability rated 9.8 on the CVSS v3 risk metric impacti...
CVE-2022-45544
Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme...
Design/Logic Flaw
DISPUTED Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as...
CVE-2022-45544
Schlix CMS 2.2.7-2 contains an insecure permission flaw that allows an attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. The vendor disputes that this is a generic vulnerability, arguing only admins should be able to upload executable PHP code. Public report...
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload (cisco-sa-sb-rv-afu-EXxwA65V)
According to its self-reported version, Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers are affected by an arbitrary file upload vulnerability due to insufficient authorization enforcement mechanisms. An unauthenticated, remote attacker can exploit this to upload arbitrary...
PT-2023-14700 · Schlix Web · Schlix Cms
Name of the Vulnerable Software and Affected Versions: Schlix Web Inc SCHLIX CMS version 2.2.7-2 Description: The issue allows an attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. However, it is noted that this functionality is intentionally allowed for admi...
Schlix CMS 安全漏洞
Schlix CMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in Schlix CMS version 2.2.7-2. An attacker can exploit the vulnerability to upload arbitrary files and execute arbitrary code via the tristao parameter...
