CVE-2021-32538

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...

Design/Logic Flaw

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...

CVE-2021-32538

ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...

CVE-2021-31721

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

CVE-2021-31721

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

Cross site scripting

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

CVE-2021-31721

Chevereto before 3.17.1 is vulnerable to Cross Site Scripting (XSS) via an image title at the image upload stage. This is corroborated across multiple sources (NVD/Red Hat/CVE list and related references). The affected product is Chevereto, and the issue is restricted to versions prior to 3.17.1....

CVE-2021-31721

Chevereto before 3.17.1 allows Cross Site Scripting XSS via an image title at the image upload stage...

Chevereto 跨站脚本漏洞

Chevereto is a graph bed program. A cross-site scripting vulnerability exists in Chevereto that stems from Chevereto allowing cross-site scripting XSS to be executed via image captions during the image upload phase...

CVE-2021-24349

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lac...

CVE-2021-24349

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lac...

PT-2021-15885 · WordPress · This Gallery From Files

Name of the Vulnerable Software and Affected Versions: This Gallery from files WordPress plugin versions 1.6.0 and earlier Description: The issue arises from the improper sanitization of filenames before being output in an error message when they have an invalid extension, leading to a reflected...

Exploit for Code Injection in Exiftool_Project Exiftool

Gitlab-Exiftool-RCE RCE Exploit for Gitlab 13.10.3 - GitL...

vFairs 代码问题漏洞

vFairs is a virtual event platform by vFairs Singapore. It can host exciting online conferences, trade shows, job fairs and more. A security vulnerability exists in vFairs 3.3, which stems from the fact that any user logged into a vFairs virtual meeting or event can abuse the functionality by...

Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFS

The plugin did not properly validate and sanitise its unsplashdownloadw and unsplashdownloadh parameter settings /wp-admin/upload.php?page=instant-images, only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue. -- Payloads: $ "div x -- PoC 1 |...

CVE-2020-20092

File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code...

Unrestricted file upload

File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code...

CVE-2020-20092

File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code...

Chevereto 3.17.1 - Cross Site Scripting (Stored) Vulnerability

Exploit Title: Chevereto 3.17.1 - Cross Site Scripting Stored Google Dork: "powered by chevereto" Exploit Author: Akıner Kısa Vendor Homepage: https://chevereto.com/ Software Link: https://chevereto.com/releases Version: 3.17.1 Tested on: Windows 10 / Xampp Proof of Concept: 1. Press the Upload...

Chevereto 3.17.1 - Cross Site Scripting (Stored)

Exploit Title: Chevereto 3.17.1 - Cross Site Scripting Stored Google Dork: "powered by chevereto" Date: 19.04.2021 Exploit Author: Akıner Kısa Vendor Homepage: https://chevereto.com/ Software Link: https://chevereto.com/releases Version: 3.17.1 Tested on: Windows 10 / Xampp Proof of Concept: 1...