CVE-2021-24347

The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be...

CVE-2021-22740

Information Exposure vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause information to be exposed when an unauthorized file is uploaded...

Schneider Electric homeLYnk和spaceLYnk 信息泄露漏洞

Schneider Electric homeLYnk and spaceLYnk are both automation programming software for different logic controllers from Schneider Electric, France. An information disclosure vulnerability exists in Schneider Electric homeLYnk and spaceLYnk, which arises from an error in configuration or other...

CVE-2021-28379

web/upload/UploadHandler.php in Vesta Control Panel aka VestaCP through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin...

CVE-2020-25406

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

CVE-2019-9534

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to...

Design/Logic Flaw

Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server informatio...

Design/Logic Flaw

An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...

CVE-2017-1000147

Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery CSRF attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into...

CVE-2017-1002016

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files...

Kirby CMS 2.1.0 CSRF / Shell Upload

============================================= - Release date: 14.09.2015 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- Kirby CMS = 2.1.0 CSRF Content Upload and PHP Script Execution II. BACKGROUND...

WordPress Daily Edition Theme Unauthorized Upload Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on servers with PHP and MySQL.WordPress Daily Edition Theme is a theme plugin for wordpress. WordPress Daily Edition Theme thumb.php fails t...

Webify Photo Gallery Arbitrary File Deletion

!x! Informations: Name : Webify photo gallery Download : http://webify.ws/photogallery Vulnerability : Delete Arbitrary File Vulnerability Author : JIKOJAWAD Contact : [email protected] Site : No-ExploiT.CoM Is Back Notes : No-ExploiT.CoM !x! Bug: Delete Arbitrary File Vulnerability you can...

CVE-2011-1409

Frams's Fast File EXchange FEX, aka fex 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID...

CVE-2011-1409

Frams's Fast File EXchange FEX, aka fex 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID...

Design/Logic Flaw

MauryCMS 0.53.2 and earlier does not require administrative authentication for Editors/fckeditor/editor/filemanager/browser/default/browser.html, which allows remote attackers to upload arbitrary files via a direct request...

Living Local 1.1 XSS / File Upload Vulnerabilities

Authot: Bgh7 Home: http://ozelteam.com - Turk Bilisim Gücleri Pst: [email protected] ============================= Dork: allinurl:clientsignup.php "classifieds" Dork2: Powered By: Living Local V1.1 Demo: http://www.jerseyads.net/listtest.php?r="alert Demo2:...

imageVue16.1.txt

ImageVue is an online Flash gallery for viewing images. For more information about ImageVue visit http://www.imagevuex.com Credits: me Vulnerable Systems: imageVue16.1 In ImageVue one can upload images to the Gallery. The upload-script however isn't checking credentials nor does it check file...

CVE-2005-3767

Exponent CMS 0.96.3 and later versions does not properly restrict the types of uploaded files, which allows remote attackers to upload and execute PHP files...

CVE-2002-0718

Web authoring command in Microsoft Content Management Server MCMS 2001 allows attackers to authenticate and upload executable content, by modifying the upload location, aka "Program Execution via MCMS Authoring Function."...