CVE-2024-42779

CVE-2024-42779 concerns Kashipara Music Management System v1.0. Affected component: the endpoint /music/ajax.php?action=save_music handles file uploads. Root cause: unrestricted file upload allows uploading a crafted PHP file, enabling arbitrary code execution on the server. Documented impact: re...

Hotel Booking System 1.0 Shell Upload

============================================================================================================================================= | Title : Hotel Booking System 1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

CVE-2024-43129

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8...

CVE-2024-40482

CVE-2024-40482 affects Kashipara Live Membership System v1.0. An unrestricted file upload in "/Membership/edit_member.php" enables attackers to upload a crafted PHP file and achieve arbitrary code execution. The CVSS basis is 9.8 (CRITICAL): Network access, no authentication, low attack complexit...

CVE-2024-5807

The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations...

CVE-2024-38529

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The...

CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The...

Lost And Found Information System 安全漏洞

Lost And Found Information System is a lost and found information system from Lost And Found. A security vulnerability exists in Lost And Found Information System version 1.0, which originates from a cross-site scripting vulnerability that allows a remote attacker to elevate the privileges of the...

PT-2024-38059 · Sourcecodester · Sourcecodester Employee/Visitor Gate Pass Logging System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 Description: A critical issue has been found in the processing of the file /employee gatepass/classes/Master.php?f=delete department, where the manipulation of the id...

PT-2024-37829 · Unknown · Sourcecodester Student Study Center Desk Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Study Center Desk Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /Master.php?f=save student. The manipulation of the id argument leads to SQL...

CVE-2024-5450

The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files...

CVE-2024-5450

CVE-2024-5450 affects the WordPress Bug Library plugin prior to version 2.1.1. The vulnerability arises because the plugin does not validate the file type of files submitted with bug reports, enabling an unauthenticated user to upload PHP files (remote code execution risk). Affected product: Word...

CVE-2024-6650

A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the function savedesignation of the file /classes/Master.php. The manipulation leads to cross site scripting. The attack may be launched remotely...

SoftExpert Excellence Suite Security Vulnerability

SoftExpert Excellence Suite is a commercial suite from SoftExpert Brazil. A security vulnerability exists in Softexpert Excellence Suite version v.2.1, which stems from a file upload vulnerability that could allow an attacker to execute arbitrary code by uploading a .php file to the...

Poultry Farm Management System 1.0 Shell Upload

Exploit Title: Poultry Farm Management System v1.0 - Remote Code Execution RCE Date: 24-06-2024 CVE: N/A Awaiting ID to be assigned Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html Software Link:...

PT-2024-37529 · Unknown · Simple Online Hotel Reservation System

Name of the Vulnerable Software and Affected Versions: Simple Online Hotel Reservation System version 1.0 Description: A critical issue has been identified, affecting the file index.php. The manipulation of the username argument leads to SQL injection. This issue can be exploited remotely...

CVE-2024-34833

Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "savesettings" page. An unauthenticated attacker can leverage this functionality to upload a malicious PHP file instead. Successful exploitation of this vulnerability results in the ability...

Payroll Management System Security Vulnerability

Payroll Management System is a payroll management system developed by Carlo Montero. A security vulnerability exists in Payroll Management System version 1.0, which can be exploited by an unauthenticated attacker to upload a malicious PHP file using the "savesettings" page's image upload...

CVE-2024-34833

Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "savesettings" page. An unauthenticated attacker can leverage this functionality to upload a malicious PHP file instead. Successful exploitation of this vulnerability results in the ability...

PHP Event Calendar SQL Injection Vulnerability

PHP Event Calendar is open source a multi-user modern event calendar based on AJAX. It is easy to integrate and fully customizable. A SQL injection vulnerability exists in PHP Event Calendar version 1.0, which stems from a security issue in the regConfirm/regDelete function of process.php, which...