CVE-2024-55515

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /uploadipslib.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded...

CVE-2024-9422 GEO My WordPress < 4.5 - Admin+ Arbitrary File Upload

The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server...

Closed Loop CLESS Server 安全漏洞

Closed Loop CLESS Server is an industrial system from Closed Loop, Inc. A security vulnerability exists in Closed Loop CLESS Server version v4.5.2, which originates from an arbitrary file upload issue in the Media Manager functionality that allows users to execute arbitrary code by uploading a...

GLPI Security Vulnerabilities

GLPI is an open source IT and asset management software from an individual developer. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and i...

PT-2024-25505 · Prestashop · Ja Marketplace

Name of the Vulnerable Software and Affected Versions: JA Marketplace module for PrestaShop versions up to 9.0.1 Description: The issue allows a guest to upload files with .php extensions, leading to a critical vulnerability. In version 6.X, the method JmarketplaceproductModuleFrontController::in...

Exploit for PHP External Variable Modification in Juniper Junos

PoC exploit for CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847. This exploit targets Juniper JunOS within SRX and EX Series products, achieving Remote Code Execution RCE by chaining four vulnerabilities. The exploit involves uploading an arbitrary PHP file to a restricted director...

WordPress 安全漏洞

WordPress is a suite of blogging platforms developed in the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress that stems from allowing an attacker to bypass the plugin installe...

VulnCheck KEV: CVE-2023-26775

File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php endpoint...

CVE-2023-4300

The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution...

CVE-2023-5150

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /useratte/web.php. The manipulation of the argument fileupload leads to unrestricted upload. It is possible to launch the...

LabCollector 代码问题漏洞

LabCollector is an all-in-one laboratory management platform from LabCollector, Inc. A security vulnerability exists in LabCollector versions 6.0 through 6.15. An attacker can exploit the vulnerability to upload executable PHP files and execute system commands...

CVE-2023-31903

GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file...

CVE-2023-23328

A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file...

PT-2023-14963 · Tecrail · Tecrail Responsive Filemanager

Name of the Vulnerable Software and Affected Versions: Tecrail Responsive FileManager versions 9.9.5 and below Description: An issue in Tecrail Responsive FileManager allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution...

Tecrail Responsive FileManager 代码问题漏洞

Tecrail Responsive FileManager is an open source file manager written in PHP by Tecrail Italy. The product supports the uploading and management of videos, images or other files. A security vulnerability exists in Tecrail Responsive FileManager v9.9.5 and earlier versions, which originates from a...

DEBIAN-CVE-2022-31086

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the...

UBUNTU-CVE-2022-31086

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the...

Design/Logic Flaw

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to...

PT-2022-13248 · WordPress · Mappress Maps

Name of the Vulnerable Software and Affected Versions: MapPress Maps for WordPress versions prior to 2.73.13 Description: The issue allows a high privileged user to bypass certain security settings and upload arbitrary files to the site through the ajax save function. The file is written relative...

CVE-2021-44087

A Remote Code Execution RCE vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remote attacker to upload a maliciously crafted PHP via photo upload...