CVE-2022-45359

CVE-2022-45359 affects the WordPress YITH WooCommerce Gift Cards Premium plugin up to version 3.19.0. The vulnerability is an unauthenticated Arbitrary File Upload via the import_actions_from_settings_panel function that runs on admin_init, allowing attackers to upload files (e.g., web shells) wi...

CVE-2022-45359 WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress...

CVE-2022-45548

AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability...

Privilege escalation

AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability...

PT-2022-27571 · Ayacms · Ayacms

Name of the Vulnerable Software and Affected Versions: AyaCMS version 3.1.2 Description: The issue is related to an Arbitrary File Upload problem. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this...

CVE-2022-45548

AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability...

AyaCMS和Upload 代码问题漏洞

AyaCMS is an extremely simple and free open source PHP website builder. A security vulnerability exists in AyaCMS v3.1.2. An attacker can use this vulnerability to upload arbitrary files...

CVE-2022-45548

AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability...

CVE-2022-45548

CVE-2022-45548 affects AyaCMS v3.1.2 with an Arbitrary File Upload vulnerability. CVSS v3.1 base score 8.8 (HIGH) indicates network access, low attack complexity, and requires low privileges with no user interaction; impact to confidentiality, integrity, and availability is HIGH. The connected do...

WordPress plugin YITH WooCommerce Gift Cards premium 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bbPress is a forum plugin used in it. WordPress plugin is an application plugin. A co...

CVE-2022-45359

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin = 3.19.0 on WordPress. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2022-1540 PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload

The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP leading to RCE...

CVE-2022-1540 PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload

The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP leading to RCE...

VulnCheck KEV: CVE-2021-24311

The wpajaxupload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users...

WordPress plugin PostmagThemes Demo Import 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2022-13941 · WordPress · Postmagthemes Demo Import

Name of the Vulnerable Software and Affected Versions: PostmagThemes Demo Import WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue allows high-privilege users, such as admins, to upload arbitrary files, including PHP files, due to a lack of validation of the imported file. This...

CVE-2022-36431

An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1...

CVE-2022-36431

An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1...

Lansweeper 路径遍历漏洞

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A path traversal vulnerability exists in Lansweeper version 10.1.1.0, which stems from the presence of a path than there, a specially crafted...

PT-2022-23365 · Rocket · Rocket Trufusion Enterprise

Name of the Vulnerable Software and Affected Versions: Rocket TRUfusion Enterprise versions prior to 7.9.6.1 Description: The issue allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. This is due to an arbitrary file upload vulnerability. Recommendations: For versio...