PT-2022-3528

Name of the Vulnerable Software and Affected Versions SEPCOS Single Package affected versions not specified Description The issue is related to the bypassing of controls that limit uploads to certain file extensions. This could allow an attacker to intercept and modify the initial file upload pag...

eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload

The plugin suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validatio...

WordPress eaSYNC plugin <= 1.1.15 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by cydave in WordPress eaSYNC plugin versions = 1.1.15. Solution Update the WordPress eaSYNC plugin to the latest available version at least 1.1.16...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54289)

Wedding Management System v1.0 is an arbitrary file upload vulnerability in the packageedit.php page, which is caused by a lack of validation of the image upload port on the packageedit.php page. The vulnerability is caused by the lack of validation of uploaded files on the packageedit.php page,...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54294)

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to arbitrary file uploads, which can be exploited by attackers to upload malicious files and remotely execute arbitrary code...

TPCMS arbitrary file upload vulnerability

TPCMS, an open source content management system from the individual developers of Source of Happiness, is vulnerable to an arbitrary file upload vulnerability in version v3.2, which stems from a lack of validation of uploaded files by the application. An attacker could exploit this vulnerability ...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54295)

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. An attacker can exploit this vulnerability to upload malicious files and remotely execute arbitrary code...

Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54291)

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. The vulnerability is caused by a lack of validation of the uploaded files in the photosedit.php page, which could be exploited to upload malicious files and remotely execute...

Path Traversal in file editor on Windows in Gogs

Impact The malicious user is able to delete and upload arbitrary files. All installations on Windows with repository upload enabled default are affected. Patches Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...

Arbitrary File Upload

github.com/mindoc-org/mindoc is vulnerable to arbitrary file upload. The vulnerability exists in Unzip function in ziptil.go due to file upload permissions and validations are not properly handled which allows an attacker to upload malicious files...

CVE-2022-31483: Improper Limitation of a Pathname to a Restricted Directory

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contai...

Arbitrary File Upload

net.mingsoft:ms-mcms is vulnerable to arbitrary file upload attacks. A remote attacker is able to inject and execute arbitrary code through a crafted ZIP file...

Code injection in MCMS

An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file...

GHSA-6XJ9-HPQ3-W3QW Code injection in MCMS

An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file...

CVE-2021-45982

NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user...

CVE-2021-45982

NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user...

CVE-2021-45982

NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user...

Design/Logic Flaw

NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user...

CVE-2021-45982

NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user...

CVE-2021-45982

CVE-2021-45982 affects NetScout nGeniusONE 6.3.2. The vulnerability allows an authenticated, privileged user to upload arbitrary files, per the CVE entry and associated records. The connected documents confirm the affected product/version and the attack capability (arbitrary file upload), but do ...