15 matches found
CVE-2024-40110
가금류 농장 관리 시스템 v1.0 - RCE 익스플로잇 취약점 유형 인증되지 않은 파일 업로드를 통한 원격 코드 실행 설명 가금류 농장 관리 시스템 v1.0은 제품 업로드 기능에 치명적인 취약점을 포함하고 있습니다. 애플리케이션이 파일 업로드를 적절하게 검증 및 필터링하지 못하여, 공격자가 제품 이미지로 위장한 PHP 파일을 업로드할 수 있습니다. 업로드된 이러한 PHP 파일이 실행되어 원격 코드 실행이 가능합니다. 취약한 엔드포인트 POST /paultry/farm/product.php or POST...
CVE-2026-19927
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-19927
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-19927
CVE-2026-19927 affects OpenBoxes up to 0.9.7, specifically the Upload endpoint in grails-app/controllers/org/pih/warehouse/product/ProductController.groovy. The issue arises from manipulating the argument params.url, enabling a server-side request forgery (SSRF) that can be exploited remotely. Ex...
CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-19927: Server-Side Request Forgery (SSRF)
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-25328
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through = 2.2.4...
Poultry-Farm-Management-System-v1.0-RCE-POC
Poultry Farm Management System v1.0 - RCE Exploit Vulnera...
i-Educar 安全漏洞
i-Educar is a free educational software open source by Portábilis. A security vulnerability exists in i-Educar that stems from a reflected cross-site scripting vulnerability in the product upload feature...
CVE-2024-1986
The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wcaddnewproduct function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files...
Input validation
The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wcaddnewproduct function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files...
Simple eCommerce <= 2.2.5 - Arbitrary File Upload
The plugin does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE...
Online Shopping Portal 3.1 - Authentication Bypass
Exploit Title: Online Shopping Portal 3.1 - Authentication Bypass Date: 2020-06-25 Exploit Author: Ümit Yalçın Vendor Homepage: https://phpgurukul.com/shopping-portal-free-download/ Version: 3.1 Tested on: Windows 10 / WampServer 1- Authentication Bypass Go to following url!...
QCMS cross-site scripting vulnerability (CNVD-2019-10277)
QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in upload/System/Controller/backend/product.php in QCMS 3.0.1, which can be exploited by remote attackers to inject arbitrary web script or HTML...