PT-2014-4564

Name of the Vulnerable Software and Affected Versions Plogger versions 1.0 RC1 and earlier Description The issue allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a direct...

PT-2014-6490

Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin versions prior to 1.4.7 Description The issue allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in...

Authentication flaw

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

PT-2014-6077

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.7 Description The issue allows remote attackers to bypass authentication and execute arbitrary PHP code. This is achieved by uploading a crafted theme using the...

CVE-2014-4725: Improper Authentication

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

PT-2013-5887

Name of the Vulnerable Software and Affected Versions Simple Dropbox Upload plugin versions prior to 1.8.8.1 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the wp-content/uploads/wpdb/ directory via the multi.php file in...

imacs CMS 0.3.0 - Unrestricted Arbitrary File Upload

imacs CMS 0.3.0 - Unrestricted Arbitrary File Upload ?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit...

PT-2012-4823

Name of the Vulnerable Software and Affected Versions Nmedia Member Conversation plugin versions prior to 1.4 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the doupload.php file, and then accessing it via a direct reque...

CVE-2009-3890

Unrestricted file upload vulnerability in the wpcheckfiletype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the modmime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an...