CVE-2022-1751: Server-Side Request Forgery (SSRF)

The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and ca...

CVE-2024-32256: Unrestricted Upload of File with Dangerous Type

Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a current package, there are no checks for what types of files are uploaded from the image...

PT-2024-24473

Name of the Vulnerable Software and Affected Versions Phpgurukul Tourism Management System version 2.0 Description The issue allows for Unrestricted Upload of File with Dangerous Type via the "/tms/admin/change-image.php" API endpoint. When updating a current package, there are no checks for what...

CVE-2024-3129: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in SourceCodester Image Accordion Gallery App 1.0. It has been classified as critical. This affects an unknown part of the file /endpoint/add-image.php. The manipulation of the argument imagename leads to unrestricted upload. It is possible to initiate the attack remotel...

CVE-2018-25094 ระบบบัญชีออนไลน์ Online Accounting System image.php path traversal

A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to...

CVE-2018-25094: Path Traversal: '../filedir'

A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to...

Adult Video Script 8.2 File Inclusion

==================================================================================================================================== | Title : Adult Video Script 8.2 RFI /LFI Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | |...

CVE-2021-42362: Unrestricted Upload of File with Dangerous Type

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain...

Joomla! com_fabrik 3.9.11 - Directory Traversal

Joomla! comfabrik 3.9.11 - Directory Traversal Exploit Title: Joomla! comfabrik 3.9.11 - Directory Traversal Google Dork: inurl:"index.php?option=comfabrik" Date: 2020-03-30 Exploit Author: qw3rTyTy Vendor Homepage: https://fabrikar.com/ Software Link: https://fabrikar.com/downloads Version: 3.9...

CVE-2013-2631

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...

Path traversal

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...

CVE-2013-2631

The CVE-2013-2631 issue affects TinyWebGallery (TWG) versions

CVE-2013-2631

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...

CVE-2013-2631: Exposure of Sensitive Information to an Unauthorized Actor

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...

irenevinkenburg.nl XSS vulnerability

Open Bug Bounty ID: OBB-683534 Description| Value ---|--- Affected Website:| irenevinkenburg.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Directory traversal

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter...

CVE-2018-16283

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter...

CVE-2018-16283

CVE-2018-16283 affects the WordPress plugin Wechat Broadcast (versions ≤ 1.2.0). The NVD/Nuclei/Exploits describe a Local/Directory Traversal vulnerability in the plugin’s Image.php that reads the GET parameter url without proper sanitization, enabling an attacker to include local or remote files...

CVE-2018-16283

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter...

CVE-2018-16283: Improper Limitation of a Pathname to a Restricted Directory

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter...