CVE-2021-38613

The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

Remote code execution

The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution...

Command injection

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

CVE-2021-38613

The CVE-2021-38613 entry concerns NASCENT RemKon Device Manager 4.0.0.0, where the assets/index.php Image Upload feature allows an attacker to upload arbitrary code and achieve remote code execution. This is driven by the documented vulnerability in the image upload function, enabling network-bas...

CVE-2021-38613

The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

NASCENT RemKon Device Manager 命令注入漏洞

NASCENT RemKon Device Manager is a NASCENT web application that is deployed in logistics centers as a single management platform for managing various settings and configurations for Automatic Gate Systems AGS and other Nascent products. A security vulnerability in NASCENT RemKon Device Manager...

NASCENT RemKon Device Manager 代码问题漏洞

NASCENT RemKon Device Manager is an automated access control system solution. A remote code execution vulnerability exists in NASCENT RemKon Device Manager version 4.0.0.0, which stems from the asset/index.php image upload function in the software, which does not effectively restrict or validate...

flatCore Cross-Site Scripting Vulnerability (CNVD-2021-94950)

flatCore is a PHP and SQLite based Web Content Management System CMS. flatCore version 2.0.7 suffers from a cross-site scripting vulnerability. An attacker can exploit the vulnerability to conduct cross-site scripting attacks via the upload image feature...

CVE-2021-39609

Cross Site Scripting XSS vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function...

Cross site scripting

Cross Site Scripting XSS vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function...

CVE-2021-39609

Cross Site Scripting XSS vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function...

FlatCore-CMS 跨站脚本漏洞

flatCore is a PHP and SQLite based Web Content Management System CMS. flatCore version 2.0.7 suffers from a cross-site scripting vulnerability. An attacker can exploit the vulnerability to conduct cross-site scripting attacks via the upload image feature...

Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls

The plugin does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user such as subscriber to call them and 1 Get and search through title and content of Draft post, 2 Get title of a password-protected post as...

XOS Shop 1.0.9 - (Multiple) Arbitrary File Deletion (Authenticated) Vulnerability

Exploit Title: XOS Shop 1.0.9 - 'Multiple' Arbitrary File Deletion Authenticated Exploit Author: faisalfs10x https://github.com/faisalfs10x Vendor Homepage: https://xos-shop.com Software Link: https://github.com/XOS-Shop/xosshopsystem/releases/tag/v1.0.9 Version: 1.0.9 Tested on: Windows 10, XAMP...

Cross-site Scripting (XSS) - Stored in chevereto/chevereto-free

✍️ Description Stored xss via image upload TESTED VESRION latest github code as of 16/7/21 🕵️‍♂️ Proof of Concept 1. First download https://github.com/ranjit-git/poc/blob/master/xss%22'%3E%3Cimg%20src%3Dx%20onerror%3Dalert123%3E.jpeg image file in linux . Dont change the file name . This type file...

ARTWARE CMS Arbitrary File Upload Vulnerability

ARTWARE CMS is an application. A web CMS. ARTWARE CMS suffers from an arbitrary file upload vulnerability, which stems from the fact that the parameters of the ARTWARE CMS image upload feature do not filter the type of files uploaded, and can be exploited by attackers to upload arbitrary files an...

CVE-2021-32538

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...