CVE-2026-9772

Unraid Web Server FileUpload Command Injection (CVE-2026-9772) allows authenticated attackers to execute arbitrary code on affected installations via a crafted FileUpload.php input, executing a system call as www-data. Root cause: insufficient validation of a user-supplied string before a system ...

CVE-2026-9772: Improper Neutralization of Special Elements used in an OS Command

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. T...

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before...

CVE-2023-7330: Unrestricted Upload of File with Dangerous Type

Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in the name and uploadDir parameters and saves the provided multipart file content without adequate validation or sanitization of...

EUVD-2015-5414

Malware in sbrugna...

CVE-2024-51053: Improper Neutralization of Input During Web Page Generation

An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-51053

An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-3803 Vesystem Cloud Desktop fileupload.php unrestricted upload

A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely...

CVE-2024-3803 Vesystem Cloud Desktop fileupload.php unrestricted upload

A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely...

CVE-2024-3803: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely...

CVE-2023-23328: Unrestricted Upload of File with Dangerous Type

A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file...

PT-2023-18910

Name of the Vulnerable Software and Affected Versions AvantFAX version 3.3.7 Description A File Upload issue exists, allowing an authenticated user to bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file. Recommendations For AvantFAX version 3.3.7, consider...

CVE-2021-44664

An Authenticated Remote Code Exection RCE vulnerability exists in Xerte through 3.9 in websitecode/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files...

PT-2022-12197

Name of the Vulnerable Software and Affected Versions Xerte versions through 3.9 Description An Authenticated Remote Code Execution RCE issue exists in the website code/php/import/fileupload.php file. This is due to the ability to upload a maliciously crafted PHP file disguised as a language file...

CVE-2021-44664: Improper Limitation of a Pathname to a Restricted Directory

An Authenticated Remote Code Exection RCE vulnerability exists in Xerte through 3.9 in websitecode/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files...

CVE-2020-19303: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file...

PT-2021-10338

Name of the Vulnerable Software and Affected Versions: hdcms version 5.7 Description: The issue is related to an arbitrary file upload vulnerability in the /fileupload.php endpoint. This allows attackers to execute arbitrary code via a crafted file. Recommendations: For hdcms version 5.7, conside...

CVE-2018-7562

A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.ph...

PT-2018-18157

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.2.2 Description A remote code execution issue was discovered, allowing temporary access to an uploaded executable file due to a race condition. The application permits authenticated users to upload files when creating...

CVE-2018-7562: Concurrent Execution using Shared Resource with Improper Synchronization

A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.ph...