CVE-2020-19802

File Upload vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the upload file type parameter...

CVE-2020-19802: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the upload file type parameter...

CVE-2020-19699

Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the tag in the upload file page...

CVE-2020-19699

Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the tag in the upload file page...

Cross site scripting

Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the tag in the upload file page...

CVE-2020-19699: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the tag in the upload file page...

CVE-2020-19699

Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the tag in the upload file page...

CVE-2021-31707

Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type...

CVE-2021-31707

CVE-2021-31707 affects KiteCMS. A permissions issue in the upload file type allows a remote attacker to execute arbitrary code. The vulnerability is characterized by a high-severity CVSS v3.1 score (9.8, CRITICAL) with network access, no privileges required, and no user interaction needed, and it...

PT-2023-12158

Name of the Vulnerable Software and Affected Versions KiteCMS affected versions not specified Description A permissions issue in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type. This enables unauthorized access and potential code execution. Recommendations At t...

CVE-2023-0340

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. R...

CVE-2023-0340 Custom Content Shortcode <= 4.0.2 - Contributor+ LFI

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. R...

CVE-2021-32302

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

Cross site scripting

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

CVE-2021-32302: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

CVE-2021-32302

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

CVE-2021-32302

CVE-2021-32302 affects IRZ Electronics RUH2 GSM router. The vulnerability is a Cross Site Scripting (XSS) flaw in the router’s vulnerability surface exposed via the Upload File parameter , enabling an attacker to obtain sensitive information. Root cause and details are corroborated by multiple so...

iRZ Mobile Routers 跨站脚本漏洞

iRZ Mobile Routers is a series of mobile routers from the Russian company iRZ. A security vulnerability exists in iRZ Mobile Routers. An attacker could use this vulnerability to obtain sensitive information via the Upload File parameter...

Remote Code Execution (RCE)

openmage/magento-lts is vulnerable to Remote Code Execution RCE. The vulnerability exists due to insufficient input validation which allows an administrator with upload file permission to create products which results in arbitrary code execution via the convert profile...

WordPress Upload File Type Settings Plugin Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Upload File Type Settings Plugin Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25781 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1b1468ec7ed1 Credits Rio Darmaw...