1617 matches found
Atom CMS SQL注入漏洞
Atom CMS is a content management system. A SQL injection vulnerability exists in Atom CMS version 2.0, which stems from a missing validation of external input SQL statements in the id parameter of /admin/ajax/avatar.php. An attacker could use this vulnerability to execute illegal SQL commands to...
Gitea 路径遍历漏洞
Gitea is an open source community-driven clone of Gogs, a popular Git self-hosted service. A directory traversal vulnerability exists on Gitea that can be exploited by an attacker to allow the avatar middleware in Gitea to allow directory traversal via a crafted URL...
CVE-2022-0442
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar...
CVE-2022-0442
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar...
Design/Logic Flaw
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar...
CVE-2022-0442 UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar...
WordPress plugin 安全漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A security vulnerability in the WordPress plugin UsersWP...
PT-2022-13187 · WordPress · Userswp
Name of the Vulnerable Software and Affected Versions: UsersWP WordPress plugin versions prior to 1.2.3.1 Description: The issue is related to missing access controls when updating a user avatar and the lack of unique file names for user avatars. This allows a logged-in user to overwrite another...
CVE-2022-25115
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
CVE-2022-25115
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
CVE-2022-25115
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
Remote code execution
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
CVE-2022-25115
CVE-2022-25115 affects Home Owners Collection Management System v1.0. The vulnerability is an RCE through the Avatar parameter in the admin path (/admin/?page=user/manage_user) when processing a crafted PNG file. The description does not provide the exact root cause or exploit details; CVSS metri...
CVE-2022-25115
A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...
CVE-2022-23906
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution RCE vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file...
CVE-2022-23906
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution RCE vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file...
CVE-2022-23906
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution RCE vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file...
Design/Logic Flaw
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution RCE vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file...
CVE-2022-23906
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution RCE vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file...
CVE-2022-0377
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the...