PT-2019-13711

Name of the Vulnerable Software and Affected Versions Social Photo Gallery plugin version 1.0 Description The issue allows remote code execution by creating an album and attaching a malicious PHP file in the cover photo album. This is possible because the file extension is not checked, enabling a...

SITOS six Build code issue vulnerability (CNVD-2019-42386)

SITOS is a modular e-learning system. The system includes features such as audio playback, video playback, forums, blogs and social media. A code issue vulnerability exists in SITOS six Build v6.2.1. The vulnerability stems from an improperly designed or implemented code development process for a...

PT-2019-4018

Name of the Vulnerable Software and Affected Versions Openregion.security module of the "Otкрытый регион" platform affected versions not specified Description The issue exists due to insufficient input validation in the openregion.security module. This allows a remote attacker to execute arbitrar...

CVE-2019-15866

The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wpajaxcrellysliderimportSlider...

CVE-2015-9338: Unrestricted Upload of File with Dangerous Type

The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files...

PT-2019-7297

Name of the Vulnerable Software and Affected Versions wp-file-upload plugin versions prior to 2.5.0 Description The issue is related to insufficient restrictions on the upload of .php files. Recommendations For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue...

PT-2019-16809

Name of the Vulnerable Software and Affected Versions WallacePOS version 1.4.3 Description The issue allows a remote, authenticated attacker to execute arbitrary code by uploading a malicious PHP file due to the unrestricted upload of files with dangerous types. Recommendations For WallacePOS...

CVE-2019-1010178

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

CVE-2019-1010178

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

CVE-2019-1010178: Incorrect Use of Privileged APIs

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

Remote code execution

In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...

Remote code execution

In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads//originals remote code execution with nginx...

PT-2019-13508

Name of the Vulnerable Software and Affected Versions Directus versions prior to 2.2.1 Description The issue allows for remote code execution due to the uploading of PHP files not being blocked. This can lead to uploads/ /originals remote code execution. Recommendations For versions prior to 2.2....

CVE-2019-13979: Unrestricted Upload of File with Dangerous Type

In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...

WordPress Insert Or Embed Articulate Content 4.2997 Remote Code Execution

Exploit Title: Authenticated code execution in insert-or-embed-articulate-content-into-wordpress Wordpress plugin Description: It is possible to upload and execute a PHP file using the plugin option to upload a zip archive Date: june 2019 Exploit Author: xulchibalraa Vendor Homepage:...

CVE-2019-12548: Unrestricted Upload of File with Dangerous Type

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

PT-2019-12848

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.9.0 Description The issue allows remote code execution for an authenticated user. This can be achieved by uploading a php file while changing the logo through the /admin/ajax/upload-logo API endpoint. Recommendations...

CVE-2019-10652: Unrestricted Upload of File with Dangerous Type

An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature...

CVE-2019-8908

An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...

Vtiger CRM 7.1.0 Remote Code Execution

Exploit Title: Vtiger CRM 7.1.0 - Remote Code Execution Date: 2018-12-27 Exploit Author: Azkan Mustafa AkkuA AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.vtiger.com Software Link: https://sourceforge.net/projects/vtigercrm/files/latest/download Version: v7.1.0 Category:...