CVE-2022-4328 WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...

CVE-2022-4328

The CVE-2022-4328 entry concerns the WordPress plugin WooCommerce Checkout Field Manager (before 18.0). The vulnerability arises from failure to validate uploaded files in the cfom_upload_file action, enabling unauthenticated remote arbitrary file uploads (e.g., PHP) to the server. Impact is desc...

WordPress plugin WooCommerce Checkout Field Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Social Sharing is a social sharing plugin used in it.WordPress plugin is an applicatio...

CVE-2022-4328: Undefined Security Weakness

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...

PT-2023-14186

Name of the Vulnerable Software and Affected Versions WooCommerce Checkout Field Manager WordPress plugin versions prior to 18.0 Description The issue allows unauthenticated attackers to upload arbitrary files, such as PHP files, to the server due to a lack of file validation for uploads. This...

WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload

The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server PoC 1. Install and activate woocommerce dependency, no setup required 2. Install and active the vulnerable plugin n-media-woocommerce-checkout-fields...

CVE-2020-25115

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...

CVE-2020-25115

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...

Design/Logic Flaw

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...

CVE-2020-25115

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...

CVE-2020-25115

Vulnerability overview: CVE-2020-25115 affects vBulletin 5.6.3 Admin CP, enabling cross-site scripting (XSS) via an Occupation Title or Description in the User Profile Field Manager. Affected component is the Admin CP interface; root cause aligns with input handling in profile field manager allow...

CVE-2020-25115: Improper Neutralization of Input During Web Page Generation

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...

PT-2020-15955

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue affects the Admin CP in vBulletin, where an XSS attack can be performed via an Occupation Title or Description to the User Profile Field Manager. Recommendations For version 5.6.3, consider disabli...