CVE-2021-41919

webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by adding or replacing a personal profile picture. The affected endpoint is /includes/upload.php on the HTTP POST data. This allows an attacker to...

PT-2021-23452

Name of the Vulnerable Software and Affected Versions webTareas versions 2.4 and earlier Description The issue allows an authenticated user to upload potentially dangerous files without restrictions by adding or replacing a personal profile picture. The affected endpoint is "/includes/upload.php"...

CVE-2021-41919: Unrestricted Upload of File with Dangerous Type

webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by adding or replacing a personal profile picture. The affected endpoint is /includes/upload.php on the HTTP POST data. This allows an attacker to...

PT-2017-6759

Name of the Vulnerable Software and Affected Versions Aviary Image Editor Add-on For Gravity Forms plugin version 3.0 beta Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the includes/upload.php file, and then accessing i...

CVE-2015-4455: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in...

CVE-2007-4139: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Temporary Uploads editing functionality wp-admin/includes/upload.php in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php...