41 matches found
CVE-2024-23734
Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted link...
Codoforum 5.2.1 File Upload
==================================================================================================================================== | Title : Codoforum v5.2.1 Arbitrary file upload Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 64.0.2...
CVE-2022-30423
Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...
CVE-2022-30423
Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...
CVE-2022-30423
Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...
Information disclosure
Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...
Merchandise Online Store 代码问题漏洞
Merchandise Online Store is a Merchandise Online Store system developed by Carlo Montero. A security vulnerability exists in Merchandise Online Store v1.0, which is caused by a remote code injection issue in the user profile upload port on the system information page...
CVE-2022-30423
Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...
CVE-2022-30423
CVE-2022-30423 affects Merchandise Online Store v1.0 by oretnom23. The vulnerability is described as an arbitrary code execution (RCE) in the user profile upload point on the system information page. The available connected documents corroborate an RCE impact but do not provide technical details ...
Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Description No CSRF in upload profile too: /index.php/e/$$$call$$$/tab/user/profile-tab/upload-profile-image. More endpoints: Reordering data: /index.php/e/$$$call$$$/grid/settings/submission-checklist/submission-checklist-grid/save-sequence...
MTN Group: Remote code execution due to unvalidated file upload
Summary: Hello I found a critical vunerability in one of your site, where user can upload any file type as a profile picture including php file Steps To Reproduce: 1. Visit https://careers.mtn.cm and register as a user. 2. After successful registration, login and update your data. 3. When uploadi...
CVE-2013-6358
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory...
CVE-2013-6358
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory...
Alstrasoft ProTaxi Enterprise 3.5 - Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Exploit Title: Alstrasoft ProTaxi Enterprise v3.5 Script - Arbitrary File Upload Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/protaxi-uber-clone.htm Demo:...
VidiScript 1.0.3a Cross Site Scripting
. \ /| | \ \ \ \ | | | | / \ / \ /\ / \ / / / / / \ /\ / \ / / / | | | Y \ / \ | | \ /\ \ \ | | /\ /\ / || || /\ \ /|| / /// \ /|| \ // / / / / / / http://thecrowscrew.org Exploit Title: VidiScript Persistent XSS Vulnerability Author: Gabby Google Dork: Powered By VidiScript...
Cross site scripting
Cross-site scripting XSS vulnerability in profile-upload/upload.asp in PD9 Software MegaBBS 1.5.14b allows remote attackers to inject arbitrary web script or HTML via the target parameter...
CVE-2008-0436
Cross-site scripting XSS vulnerability in profile-upload/upload.asp in PD9 Software MegaBBS 1.5.14b allows remote attackers to inject arbitrary web script or HTML via the target parameter...
CVE-2008-0436
CVE-2008-0436 refers to a cross-site scripting (XSS) vulnerability in PD9 Software MegaBBS 1.5.14b. The flaw resides in the profile-upload/upload.asp endpoint, exploitable via the target parameter to inject arbitrary web script or HTML. NVD indicates the attack could be remote and non-authenticat...
CVE-2007-6479
Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php aka the "My profile" page in Dokeos 1.8.4 allows remote authenticated users to upload and execute arbitrary PHP files via a filename with a double extension, which can then be accessed through a URI...