Design/Logic Flaw

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...

CVE-2022-27952

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-27952

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-27263

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

CVE-2022-27952: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-28397: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

PT-2022-18718

Name of the Vulnerable Software and Affected Versions PayloadCMS version 0.15.0 Description The issue allows attackers to execute arbitrary code via a crafted SVG file, exploiting an arbitrary file upload vulnerability in the file upload module. Recommendations For PayloadCMS version 0.15.0,...

PT-2022-18339

Name of the Vulnerable Software and Affected Versions Skipper version 0.9.1 Description The issue is related to an arbitrary file upload vulnerability in the file upload module, allowing attackers to execute arbitrary code via a crafted file. Recommendations For Skipper version 0.9.1, at the...

CVE-2022-27140: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...

PT-2022-18340

Name of the Vulnerable Software and Affected Versions Strapi version 4.1.5 Description An arbitrary file upload vulnerability in the file upload module allows attackers to execute arbitrary code via a crafted file. Recommendations For Strapi version 4.1.5, at the moment, there is no information...

CVE-2022-27139: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

CVE-2022-27262: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-27263: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file...

CVE-2020-36485

Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file...

CVE-2020-23043

Tran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted file...

CVE-2020-36485

Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file...

PT-2021-10820

Name of the Vulnerable Software and Affected Versions Tran Tu Air Sender version 1.0.2 Description The issue allows attackers to execute arbitrary code via a crafted file, exploiting an arbitrary file upload vulnerability in the upload module. Recommendations For version 1.0.2, consider disabling...

Portable Ltd Playable: Code-related vulnerabilities

Portable Ltd Playable is a Full HD media player for Pc from Portable Ltd, UK. A security vulnerability exists in Portable Playable v9.18, which stems from a lack of effective filtering and restriction in the filename parameter of the software's upload module. The vulnerability allows an attacker ...