15961 matches found
CVE-2023-24734
PMB v7.4.6 is affected by an arbitrary file upload vulnerability in the camera_upload.php component that enables attackers to execute arbitrary code via a crafted image file. Affected product/entity: PMB 7.4.6; vulnerable component: camera_upload.php. Root cause not explicitly stated beyond “arbi...
CVE-2023-24734
An arbitrary file upload vulnerability in the cameraupload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file...
CVE-2023-26949
CVE-2023-26949 affects onekeyadmin v1.3.9; the arbitrary file upload flaw in /admin1/config/update allows executing arbitrary PHP code. Connected sources corroborate the issue, but no patch/version remediation details are provided in the supplied documents. Exploitation information is not fully d...
CVE-2023-24734: Use After Free
An arbitrary file upload vulnerability in the cameraupload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file...
PT-2023-20866 · Unknown · Onekeyadmin
Name of the Vulnerable Software and Affected Versions: onekeyadmin version 1.3.9 Description: The issue is related to an arbitrary file upload vulnerability in the /admin1/config/update component, allowing attackers to execute arbitrary code via a crafted PHP file. Recommendations: For onekeyadmi...
PMB 资源管理错误漏洞
PMB is a 100% free document management reference tool from the PMB Services team. A security vulnerability exists in PMB version v7.4.6, which stems from an arbitrary file upload vulnerability contained in the cameraupload.php component. An attacker could exploit the vulnerability to execute...
OneKeyAdmin 代码问题漏洞
OneKeyAdmin is About plug-in management system based on Thinkphp6+Element, website, applets, malls, CMS, APP, ERP, API interface a system to get it all done, no scaffolding out of the box! OneKeyAdmin v1.3.9 version of the existence of security vulnerabilities , the vulnerability stems from the...
CVE-2022-4328: Undefined Security Weakness
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...
CVE-2023-26949
An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2023-26949: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2023-22336: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to upload a specially crafted file to an arbitrary directory. As a result of exploiting this vulnerability with CVE-2023-22335 and CVE-2023-22344 vulnerabilitie...
WordPress Types Plugin <= 3.4.17 is vulnerable to Arbitrary File Upload
Software Types Type Plugin Vulnerable versions = 3.4.17 Fixed in 3.4.18 OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2023-27440 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID f01af6037806 Credits Dave Jong Patchstack Required...
yf-exam 代码问题漏洞
yf-exam CloudFan Training Exam System is a training exam system for CleverStupidDog individual developers. A security vulnerability exists in CleverStupidDog yf-exam version 1.8.0, which stems from the lack of restriction on the suffix of uploaded files, resulting in an arbitrary file upload...
WordPress Auto Featured Image (Auto Post Thumbnail) Plugin < 3.9.16 is vulnerable to Arbitrary File Upload
Software Auto Featured Image Auto Post Thumbnail Type Plugin Vulnerable versions 3.9.16 Fixed in 3.9.16 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-0477 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID ad8cfc8bf738 Credits dc11 Required...
Arbitrary File Upload
encore/laravel-admin is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate files uploaded, allowing an attacker to bypass the file upload restrictions by uploading a malicious .php file...
Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload Exploit
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Oracle Web Applications Desktop Integrator, as shipped with Oracle EBS versions 12.2.3 through to 12.2.11, in order to gain remote code execution as the oracle user. This module requires Metasploit:...
Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'Oracle E-Business Suite EBS Unauthenticated Arbitrary File Upload', 'Description' = %q This module exploits an unauthenticated...
GHSA-G857-47PM-3R32 laravel-admin has Arbitrary File Upload vulnerability
An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file...
laravel-admin has Arbitrary File Upload vulnerability
An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file...
