The vulnerability in the lib/NSSDropoff.php web application script for transferring ZendTo files allows a hacker to execute arbitrary commands.

The vulnerability in the lib/NSSDropoff.php web application for transferring files of the ZendTo format exists due to the lack of measures taken to neutralize special elements used in the operating system’s command processing when handling the tmpname parameter. Exploiting this vulnerability allo...

CVE-2025-66384

app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmpname...

ZendTo 安全漏洞

ZendTo is a web-based file transfer system from ZendTo, Inc. A security vulnerability exists in ZendTo versions 5.24-3 through prior to 6.10-7, which stems from the presence of shell metacharacters in the tmpname parameter, and could lead to the execution of arbitrary commands by an...

PT-2019-12065

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 3.0.23 Description The issue allows an attacker to traverse the file system and access files, as well as execute code. This is achieved through the includes/fields/upload.php page, specifically via the name...