Malicious Code Injection

guvnor-m2repo-editor-backend is vulnerable to malicious code injection. The attacker can inject arbitrary code by uploading a pom.xml with errors to business central using Artifact Repository as the upload function shows the error message in an HTML mode...

Exploit for Path Traversal in Bludit

CVE-2019-16113 PoC Bludit = 3.9.2 Remote Code Execution Vuln...

Gigamon GigaVUE Path Traversal Vulnerability

Gigamon GigaVUE is a set of network monitoring solutions from Gigamon, USA. The product supports features such as network traffic monitoring and sensitive data obfuscation. A path traversal vulnerability exists in the upload function in Gigamon GigaVUE version 5.5.01.11. An attacker can exploit...

Vulnerability of the sja1105_static_config Upload() function (drivers/net/dsa/sja1105/sja1105_spi.c) in the Linux kernel, allowing a hacker to trigger a service failure

The vulnerability of the sja1105staticconfig Upload function drivers/net/dsa/sja1105/sja1105spi.c in the Linux kernel involves uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2019-5207 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to the incorrect handling of media during upload in the WordPress content management system, specifically affecting the wp ajax upload attachment function. This can allow a...

CVE-2019-11767

Summary of CVE-2019-11767: A server-side request forgery (SSRF) vulnerability in phpBB prior to 3.2.6. The issue, triggered via the remote avatar upload function, enables an attacker to check for the existence of files and services on the host’s local network. Affected software: phpBB versions be...

Vimeo: SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]

Using our upload feature, the user was able to force an SSRF to occur. For more information you can read my writeup: https://medium.com/@dPhoeniixx/vimeo-upload-function-ssrf-7466d8630437...

CVE-2018-6012

The 'Weather Service' feature of the Green Electronics RainMachine Mini-8 2nd generation allows an attacker to inject arbitrary Python code via the 'Add new weather data source' upload function...

Cisco Cloud Services Platform 2100 Web Upload Function Code Injection Vulnerability

A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain restricted shell access on an affected system. The vulnerability is due to insufficient input validation of parameters passed to a specific function within the...

CVE-2018-9848

In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the configuploadclass value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an...

CVE-2018-9848

In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the configuploadclass value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an...

CVE-2018-9848

In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the configuploadclass value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an...

CVE-2018-9848

In GxlcmsQY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote arbitrary PHP code execution. An attacker first sends Admin-Admin-Configsave to modify config[upload_class] from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php, then issues Admin-Upload-Upload to run...

CVE-2017-13670

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...

Design/Logic Flaw

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...

Robert 0.5 - Multiple Vulnerabilities

Exploit Title: Robert 0.5 - Multiple Vulnerabilities XSS, CSRF, Directory traversal & SQLi Date: 07/06/2017 Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT Vendor website :http://robert.polosson.com/ Download link : https://github.com/RobertManager/robert/archive/master.zip Live demo :...

The vulnerability of the PHP interpreter, which allows a remote attacker to create a file with an incorrect name

A vulnerability in the PHP interpreter’s moveuploadedfile function exists due to the truncation of the path when the character \x00 is present. As a result of exploiting this vulnerability, a malicious actor can create a file with an incorrect name, circumventing the restrictions imposed on the...

WordPress Ultimate Product Catalog 3.8.6 Shell Upload

Exploit Title: Wordpress Ultimate-Product-Catalog v3.8.6 Arbitrary file RCE Date: 2016-06-23 Google Dork: Index of /wp-content/plugins/ultimate-product-catalogue/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Vendor Homepage: http://www.EtoileWebDesign.com/ plugin uri:...

phpATM 1.32 Remote Command Execution / Shell Upload

?php / Exploit Title : "phpATM = 1.32 Remote Command Execution Shell Upload on Windows Servers" Date : 17/06/2016 Author : Paolo Massenio - pmassenioATgmail Vendor : phpATM - http://phpatm.org/ Version : = 1.32 Tested on : Windows 10 with XAMPP PoF "phpATM is the acronym for PHP Advanced Transfer...

蝉知CMS5.3 CRSF getshell

简要描述： 蝉知CMS5.3 CRSF getshell 详细说明： /system/module/package/control.php public function upload$type = 'extension' $this-view-canManage = array'result' = 'success'; if!$this-loadModel'guarder'-verify $this-view-canManage = $this-loadModel'common'-verifyAdmin; if$SERVER'REQUESTMETHOD' == 'POST'...