1883 matches found
CVE-2021-28566
Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated...
Cross-site Scripting in OpenCart
OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section...
GHSA-36FM-V9WV-56JF Cross-site Scripting in OpenCart
OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section...
CVE-2021-24236
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename...
WordPress 代码问题漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability in the WordPress plugin Imagements version 1.2.5 and earlier versions allow...
Centreon Web 安全漏洞
Centreon Web is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . An upload bypass vulnerability exists in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2, which...
Montiorr 1.7.6m Cross Site Scripting
Exploit Title: Montiorr 1.7.6m - File Upload to XSS Date: 25/4/2021 Exploit Author: Ahmad Shakla Software Link: https://github.com/Monitorr/Monitorr Tested on: Kali GNU/Linux 2020.2 Detailed Bug Description : https://arabcyberclub.blogspot.com/2021/04/monitor-176m-file-upload-to-xss.html An...
Montiorr 1.7.6m - File Upload to XSS Vulnerability
Exploit Title: Montiorr 1.7.6m - File Upload to XSS Exploit Author: Ahmad Shakla Software Link: https://github.com/Monitorr/Monitorr Tested on: Kali GNU/Linux 2020.2 Detailed Bug Description : https://arabcyberclub.blogspot.com/2021/04/monitor-176m-file-upload-to-xss.html An attacker can preform ...
Montiorr 1.7.6m - Persistent Cross-Site Scripting
Exploit Title: Montiorr 1.7.6m - Persistent Cross-Site Scripting Date: 25/4/2021 Exploit Author: Ahmad Shakla Software Link: https://github.com/Monitorr/Monitorr Tested on: Kali GNU/Linux 2020.2 Detailed Bug Description :...
Composr 10.0.36 - Remote Code Execution
Exploit Title: Composr 10.0.36 - Remote Code Execution Date: 04/06/2021 Exploit Author: Orion Hridoy Vendor Homepage: https://compo.sr/ Software Link: https://compo.sr/download.htm Version: 10.0.36 Tested on: Windows/Linux CVE : CVE-2021-30149 A RCE on Composr CMS has been discovered by BugsBD...
CVE-2020-28173
Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=savesettings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/...
CVE-2020-28173
Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=savesettings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/...
Design/Logic Flaw
Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=savesettings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/...
CVE-2020-28173
The CVE-2020-28173 entry relates to Sourcecodester Simple College Website 1.0. Affects the image upload workflow (upload to /alumni/admin/assets/uploads/) via /alumni/admin/ajax.php?action=save_settings, enabling remote code execution. Root cause is a vulnerable image upload function that permits...
Exploit for Path Traversal in Rukovoditel
PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CV...
Design/Logic Flaw
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...
rConfig 3.9.6 Shell Upload
Exploit Title: rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution Authenticated Date: 2021-03-17 Exploit Author: Murat ŞEKER Vendor Homepage: https://www.rconfig.com Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip Version: rConfig v3.9.6 Install scripts :...
CVE-2020-14988
An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...
CVE-2020-14988
An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...