CVE-2022-34025

Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...

CVE-2021-41661

Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessible through the /uploads directory. This can lead to RCE on the web server by uploading a PHP webshell...

CVE-2022-27140

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...

CVE-2022-23880

An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-0440

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog ie DISALLOWUNFILTEREDHTML, DISALLOWFILEEDIT and DISALLOWFILEMODS...

Xerte 代码问题漏洞

Xerte is an open source software from The Xerte Project community in the UK. Xerte is vulnerable to a code issue where a maliciously crafted php file can be uploaded via a project interface disguised as a language file to bypass upload filters. An attacker could exploit the vulnerability to...

The vulnerability of the FUDforum internet forum, related to the lack of measures taken to protect the website structure, allows a perpetrator to execute arbitrary code.

The vulnerability of the FUDforum internet forum is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to inject arbitrary code during the administrator’s email reading process. This code can then...

CVE-2021-40909

Cross site scripting XSS vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial v1 by oretnom23, allows remote attackers to execute arbitrary code via the firstname, lastname, and email parameters to /ajaxcrud...

ProjectWorlds Online Shopping System 跨站请求伪造漏洞

Projectworlds Online Shopping System is an online shopping system from the Austrian company Projectworlds.A security vulnerability exists in Projectworlds Online Shopping System PHP, which stems from a CSRF vulnerability in ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in...

CVE-2021-41646

Remote Code Execution RCE vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters...

RGCMS 代码问题漏洞

RGCMS is a web CMS. v1.06 of RGCMS contains a security vulnerability that can be exploited by attackers to execute arbitrary code via a crafted .txt file, which will later be changed to a PHP file...

WordPress 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Easy Social Icons plugin is a WordPress open source application plugin. WordPress Easy Social Icons plugin in...

CVE-2021-29377

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt...

Egavilan Media Bakeshop Online Ordering System 代码问题漏洞

Egavilan Media Bakeshop Online Ordering System is a Javascript-based code repository that supports interaction with git repositories from Egavilan Media. A security vulnerability exists in Online Ordering System 1.0 that allows the upload of arbitrary .php files, which could lead to remote code...

PT-2021-11913 · Zenphoto · Zenphoto

Name of the Vulnerable Software and Affected Versions: Zenphoto versions 1.5.7 and earlier Description: The issue allows for authenticated arbitrary file upload, leading to remote code execution. An attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop file...

Microweber Unrestricted File Upload Vulnerability

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in the Microweber administrator account page. An attacke...

Reload vulnerability in ZZCMS in***.php page

ZZCMS is a free website builder developed in asp language. A reinstallation vulnerability exists in the ZZCMS in.php page. An attacker can exploit the vulnerability to overwrite previous files resulting in a system reinstallation...

CVE-2020-1182

A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...

CVE-2020-1182

A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...

Remote code execution

A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...