461 matches found
PT-2022-27395 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.2 Description: The issue concerns an unrestricted upload of a file with a dangerous type in the GitHub repository openemr/openemr. Recommendations: For versions prior to 7.0.0.2, update to version 7.0.0.2 or...
CVE-2022-43708
MyBB 1.8.31 has a issue 2 of 2 cross-site scripting XSS vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name...
CVE-2022-3126 Frontend File Manager < 21.4 - File Upload via CSRF
The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf...
PT-2022-26515 · Redcap · Redcap
Name of the Vulnerable Software and Affected Versions: REDCap versions prior to 12.04.18 Description: A reflected XSS issue exists in the Alerts & Notifications upload feature, allowing arbitrary JavaScript code execution when a crafted CSV file is uploaded. Recommendations: For versions prior to...
PT-2022-20633
Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin WordPress plugin versions prior to 21.3 Description The issue allows any unauthenticated user to rename uploaded files from users. Due to the lack of validation in the destination filename, this could allow them to...
CVE-2022-40358
An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload...
PT-2022-21129 · Cloudreve · Cloudreve
Name of the Vulnerable Software and Affected Versions: Cloudreve versions v1.0.0 through v3.5.3 Description: The issue is related to Stored Cross-Site Scripting XSS via the file upload functionality. A low-privileged user can share a file with an admin user, potentially leading to privilege...
PT-2022-12119 · Anydesk · Anydesk
Name of the Vulnerable Software and Affected Versions: AnyDesk versions prior to 6.2.6 AnyDesk versions 6.3.x prior to 6.3.5 Description: An issue allows the upload of an arbitrary file to a victim's local /Downloads/ directory without approval or action taken by the victim. This occurs when the...
PT-2022-17185 · Unknown · Octopus Deploy
Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows uploading a package to the built-in feed with insufficient permissions after re-indexing packages. Recommendations: At the moment, there is no information about a...
CVE-2022-36065 GrowthBook account creation and file upload vulnerability in self-hosted configurations
GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the righ...
CVE-2022-36486
TOTOLINK N350RT V9.3.5u.6139B20201216 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile...
PT-2022-22026 · WordPress · Ideastocode Enable Svg
Name of the Vulnerable Software and Affected Versions: ideasToCode Enable SVG, WebP & ICO Upload plugin version 1.0.1 and earlier Description: The issue allows authenticated users with author or higher roles to upload arbitrary files. This can be exploited by uploading malicious files to the...
PT-2022-22181 · Hiby · Hiby R3 Pro
Name of the Vulnerable Software and Affected Versions: Hiby R3 PRO firmware versions 1.5 through 1.7 Description: A file upload issue was found in the file upload feature of the firmware. Recommendations: For versions 1.5 through 1.7, update to a newer version that contains a fix for this issue...
GHSA-54JJ-PXX2-PV8H TYPO3 doesn't properly check file extensions
The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...
CVE-2020-19228
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files...
GHSA-RC8Q-45V8-X6XC Path Disclosure within joomla/filesystem class
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application...
PT-2021-15554 · Unknown · Unisharp/Laravel-Filemanager
Name of the Vulnerable Software and Affected Versions: unisharp/laravel-filemanager versions prior to 2.6.2 Description: The issue arises from insufficient validation of file types during the upload process, specifically in the upload function. This allows an attacker to potentially upload...
LimeSurvey 跨站脚本漏洞
LimeSurvey formerly known as PHPSurveyor is an open source online survey program from the LimeSurvey Limesurvey team that supports survey development, survey distribution, and data collection.LimeSurvey is vulnerable to a cross-site scripting vulnerability that originates in LimeSurvey 3.x- The...
WordPress plugin code issue vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A code issue vulnerability exists in Kaswara Modern VC...
