WordPress ThemeREX Addons plugin <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data vulnerability

Unauthenticated Arbitrary File Upload in trxaddonsuploadssavedata vulnerability discovered by Tonn in WordPress Plugin ThemeREX Addons versions = 2.32.3...

CVE-2024-13117

CVE-2024-13117 affects Social Share Buttons for WordPress (plugin) up to version 2.7, allowing unauthenticated users to upload arbitrary images and alter the upload path. Root cause: improper upload handling enabling arbitrary file upload and path traversal. Impact: potential for arbitrary file u...

WordPress plugin WPBot Pro Wordpress Chatbot 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress WPBot Pro Wordpress Chatbot plugin <= 13.5.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin WPBot Pro Wordpress Chatbot versions = 13.5.4...

CVE-2024-56064

CVE-2024-56064 affects the WordPress plugin WP SuperBackup (indeed-wp-superbackup)

PT-2024-17534 · WordPress · Ar

Name of the Vulnerable Software and Affected Versions: AR for WordPress plugin for WordPress versions up to, and including, 7.3 Description: The issue is related to unauthorized double extension file upload due to a missing capability check on the set ar featured image function. This allows...

WordPress SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Tonn in WordPress Plugin WP SuperBackup versions = 2.3.3...

CVE-2024-9659

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mjsmgtuseravatarimageupload function in all versions up to, and including, 91.5.0. This makes it possible for unauthenticated attackers to upload...

CVE-2024-11312

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells...

PT-2024-16902 · Trcore · Trcore Dvc

Name of the Vulnerable Software and Affected Versions: TRCore DVC affected versions not specified Description: The issue concerns a Path Traversal vulnerability in the DVC from TRCore, which also fails to restrict the types of files that can be uploaded. This vulnerability allows unauthenticated...

PT-2024-16706 · Unknown · Grand Vice Info Webopac

Name of the Vulnerable Software and Affected Versions: Grand Vice Info Webopac versions up to 6.5.0/7.2.2 Description: The issue is related to the lack of proper file type validation in the Webopac component, allowing unauthenticated remote attackers to upload and execute webshells. This could le...

PT-2024-39947

Name of the Vulnerable Software and Affected Versions Wux Blog Editor plugin for WordPress versions up to and including 3.0.0 Description The Wux Blog Editor plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the wuxbt insertImageNew...

Money Manager EX WebApp 安全漏洞

Money Manager EX WebApp is an open source personal finance management software from Money Manager EX. A security vulnerability exists in Money Manager EX WebApp version 1.2.2, which stems from an access control error, where the function fails to terminate script execution after redirecting an...

PT-2024-11046

Name of the Vulnerable Software and Affected Versions ZoomSounds plugin for WordPress versions up to, and including, 5.96 Description The issue is related to missing file type validation in the 'savepng.php' file, which allows unauthenticated attackers to upload arbitrary files on the affected...

TEM Opera Plus FM Family Transmitter 访问控制错误漏洞

The TEM Opera Plus FM Family Transmitter is a frequency modulation FM transmitter device from TEM. An access control error vulnerability exists in TEM Opera Plus FM Family Transmitter version 35.45, which arises from allowing access to an unprotected endpoint that can upload a binary image of the...

PT-2024-29677 · Unknown · Tem Opera Plus Fm Family Transmitter

Name of the Vulnerable Software and Affected Versions: TEM Opera Plus FM Family Transmitter affected versions not specified Description: The TEM Opera Plus FM Family Transmitter has an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system i...

CVE-2024-7772

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

VulnCheck KEV: CVE-2023-43478

fakeupload.cgi on the Telstra Smart Modem Gen 2 Arcadyan LH1000, firmware versions 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code...

CVE-2024-7447

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsfaf2handelfileupload' function in all versions up to, and including, 3.7.3.2. Th...

CVE-2024-7447 Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsfaf2handelfileupload' function in all versions up to, and including, 3.7.3.2. Th...