Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the isFileTypeAllowed function in the Bucket component. An attacker can execute arbitrary code on the server by renaming files with a .php extension through specially crafted filenames. This is only exploitable...

PT-2025-27857 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: Cockpit versions up to 2.11.3 Description: A issue was found in the processing of the file /system/users/save, where the manipulation of the argument name or email leads to cross-site scripting. The attack may be initiated remotely. It is...