186 matches found
webuploader-0.1.15-Demo
webuploader-v-0.1.15 コンポーネントにファイルアップロードの脆弱性（未認証） 概要：Baidu WebUploaderコンポーネントにファイルアップロードの脆弱性が存在します。この脆弱性は、WebUploaderコンポーネントのアップロードページがファイルタイプまたはファイル拡張子のフィルタリングを厳格に行っていないことに起因します。攻撃者はこの脆弱性を利用して、スクリプトファイルを直接アップロードするか、制限を簡単にバイパスしてアップロードし、システムコマンドを実行してWebサイトのサーバー権限を取得できます。 server/preview.php...
CVE-2026-57827
CVE-2026-57827 Joomla RSFiles 未認証ファイルアップロードCVE-2026-57827検出&悪用スクリプト...
CVE-2026-77269
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...
CVE-2021-21972
CVE-2021-21972 VMware vSphere Client の権限のないファイルアップロードによるリモートコード実行 RCE vSphere Web Client HTML5 は本質的に、vSphere インストールを管理するための管理インターフェースです。vSphere Client は、vSphere サーバーに直接アクセスすることなく、vSphere の主要機能へのアクセスを管理者に提供します。これにより、管理者は新しい仮想マシンを作成し、既存の仮想マシンとそのリソースを管理できます。クロスプラットフォームの Web...
CVE-2023-22518
CVE-2023-22518 익스플로잇 설명 이 저장소에는 CVE-2023-22518에 대한 익스플로잇 스크립트가 포함되어 있습니다. 이 스크립트는 승인되지 않은 파일 업로드를 허용하여 잠재적으로 원격 코드 실행 또는 기타 보안 취약점으로 이어질 수 있습니다. 면책 조항 이 저장소는 교육 및 정보 제공 목적으로만 제공됩니다. 이 익스플로잇 스크립트의 무단 사용은 엄격히 금지됩니다. 책임감을 갖고 윤리적 해킹 원칙을 존중하십시오. 취약점 세부 정보 CVE ID: CVE-2023-22518 취약점 유형: 승인되지 않은 파일 업로드...
CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
PT-2026-55262
Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description An unauthenticated arbitrary file upload issue exists in the com.sksoft.bill.ImageUpload servlet. Unauthenticated attackers can upload arbitrary files by submitting a POST request to the endpoint without...
CVE-2026-38329
Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...
CVE-2026-35573
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The...
Exploit for Unrestricted Upload of File with Dangerous Type in Webfulcreations Computer_Repair_Shop
CVE-2024-51793 / 0-Click RCE Exploit - Author: Joshua Provost...
CVE-2021-22736
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a denial of service when an unauthorized file is uploaded...
CVE-2019-18320
A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to upload arbitrary files without authentication. Please note that an attacker needs to have network access to the...
CVE-2025-14045: Missing Authorization
The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the urlmediauploaderurluploadajaxhandler function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-leve...
PT-2025-47787
Name of the Vulnerable Software and Affected Versions S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress versions through 1.7.8 Description The software is susceptible to arbitrary file uploads because of a lack of file type validation within the storeFile...
EUVD-2017-16959
Malware in sbrugna...
EUVD-2020-28647
Malware in sbrugna...
EUVD-2019-5856
Malware in sbrugna...
EUVD-2021-9875
Malicious code in bioql PyPI...