MAL-2026-13549 Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

CVE-2022-4995: Unrestricted Upload of File with Dangerous Type

Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...

PT-2026-69048

Name of the Vulnerable Software and Affected Versions Weaver Fanwei E-cology 9.0 versions prior to 10.52 Description A file upload issue allows a remote, unauthenticated attacker to upload arbitrary files, such as JSP webshells. This is achieved by submitting a multipart/form-data POST request to...

CVE-2026-9187

The Abandoned Contact Form 7 plugin for WordPress (

CVE-2012-10045: Unrestricted Upload of File with Dangerous Type

XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST...

CVE-2013-10055: Unrestricted Upload of File with Dangerous Type

An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 and possibly earlier in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a...

PT-2025-5672 · Uniapi · Uniapi

Name of the Vulnerable Software and Affected Versions: uniapi version 1.0.7 Description: The issue concerns code introduced in a specific version of the software that executes upon import of the module. This code downloads a script from a remote URL and then executes the downloaded script in a...

PT-2020-7936

Name of the Vulnerable Software and Affected Versions: gmail-js versions prior to 0.6.5 Description: The issue concerns cross-site scripting in certain functions, specifically tools.parse response, helper.get.visible emails post, and helper.get.email data post, which directly pass user input into...

PT-2018-13451

Name of the Vulnerable Software and Affected Versions damiCMS version 6.0.1 Description An issue allows remote code execution via PHP code in a multipart/form-data POST to the "admin.php?s=/Tpl/Update.html" API endpoint. This can be used to update files, such as Web/Tpl/default/head.html...

CVE-2016-6342

elog 3.1.1 allows remote attackers to post data as any username in the logbook...

CVE-2017-7185

Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...

Directory traversal

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. dot dot in a filename within a multipart/form-data POST request to a LiveTime.woa URL...

CVE-2012-2627

d4d/uploader.php in the web console in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request...

PT-2012-4141

Name of the Vulnerable Software and Affected Versions Plixer Scrutinizer aka Dell SonicWALL Scrutinizer versions prior to 9.5.0 Description The issue allows remote attackers to create or overwrite arbitrary files in the %PROGRAMFILES%Scrutinizersnmpmibs directory via a multipart/form-data POST...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : php5 vulnerabilities (USN-862-1)

Maksymilian Arciemowicz discovered that PHP did not properly validate arguments to the dbareplace function. If a script passed untrusted input to the dbareplace function, an attacker could truncate the database. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, and 8.10. CVE-2008-7068 It was...

CVE-2006-1668: Undefined Security Weakness

newimage.php in Eric Gerdes Crafty Syntax Image Gallery CSIG aka PHP thumbnail Photo Gallery 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code via a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php...