345 matches found
PYSEC-2023-296
An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system...
CVE-2023-6120
The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the uploadcertificatefile function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server...
GL.iNet AX1800 Security Vulnerability
The GL.iNet AX1800 is a wireless router from China's Guanglian Zhitong GL.iNet. A security vulnerability exists in the GL.iNet AX1800 version 4.0.0 prior to 4.5.0, which originated from a vulnerability that allows attackers to execute arbitrary code via the upload API function...
PT-2023-28210 · Ca · Arcserve Udp
Name of the Vulnerable Software and Affected Versions: Arcserve UDP versions prior to 9.2 Description: The issue allows an unauthenticated remote attacker to exploit a path traversal vulnerability in the com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload function to upload arbitrary...
PT-2023-32328 · Sourcecodester · Sourcecodester File Manager App
Name of the Vulnerable Software and Affected Versions: SourceCodester File Manager App version 1.0 Description: A critical vulnerability was found in the SourceCodester File Manager App, affecting an unknown functionality of the file endpoint "add-file.php". The manipulation of the uploadedFileNa...
CVE-2023-41631
eSST Monitoring v2.147.1 was discovered to contain a remote code execution RCE vulnerability via the file upload function...
CVE-2023-41631
eSST Monitoring v2.147.1 was discovered to contain a remote code execution RCE vulnerability via the file upload function...
Cross-site Scripting (XSS)
cockpit-hq/cockpit is vulnerable to Stored Cross-site Scripting XSS. The vulnerability exists in the upload function at bootstrap.php due to lack of MIME sanitization which allows an attacker to inject and execute arbitrary JavaScript...
Cross-site Scripting (XSS)
cockpit-hq/cockpit is vulnerable to Cross-site Scripting XSS. The vulnerability exists in upload function at bootstrap.php because due to improper sanitization of inputs which allows an attacker to inject and execute arbitrary javascript...
PHOENIX CONTACTs WP 6xxx series web panels Security Vulnerability
PHOENIX CONTACTs WP 6xxx series web panels are a series of web panels from PHOENIX CONTACTs, Germany. A security vulnerability in PHOENIX CONTACTs WP 6xxx series web panels prior to version 4.0.10 exists in the web panels where an unauthenticated, remote attacker can access the upload function of...
CVE-2023-36220
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function...
Directory traversal
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function...
CVE-2023-36220: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function...
CVE-2023-36220
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function...
CVE-2023-36220
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function...
CVE-2023-36970
A Cross-site scripting XSS vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function...
CVE-2023-36969
CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function...
CVE-2023-36969
CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function...
PT-2023-25757 · Unknown · Cms Made Simple
Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.17 Description: The issue allows for Remote Command Execution via the File Upload Function. Recommendations: For CMS Made Simple version 2.2.17, update to a version that fixes this issue...