PT-2023-27312 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.11 Description: DataEase is an open source data visualization and analysis tool. The program only uses the ImageIO.read method to determine whether the file is an image file or not. There is no whitelisting...

Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File Upload

Description The plugin does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution. PoC NOTE: Because of an error in this version of the plugin, the following POC only works on PHP versions previous to 8.0. 1. As an...

U.S. Dept Of Defense: RCE via File Upload with a Null Byte Truncated File Extension at https://██████/

A remote code execution vulnerability via file upload with a null byte truncated file extension was found on a website. By uploading a file with .asp%00.png extension, malicious ASP code could be executed on the server. This allowed an attacker to run arbitrary system commands. The issue was...

CVE-2022-38140

Summary of CVE-2022-38140 : The WordPress SEO Plugin by Squirrly SEO (versions ≤ 12.1.10) is vulnerable to an Arbitrary File Upload issue exploitable by users with a contributor role or higher. The root cause described across sources is inadequate validation/handling of uploaded files, allowing u...

PT-2022-26739 · Ayacms · Ayacms

Name of the Vulnerable Software and Affected Versions: AyaCMS version 3.1.2 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the /admin/fst upload.inc.php component. Recommendations: For AyaCMS version...

CVE-2022-42201

Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload...

CVE-2022-2872 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload

The plugin does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded. PoC 1 Create a file named exploit.php, which contains:...

CVE-2022-31041 Insufficient content-type validation for uploaded files in open-forms

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users e.g. only PDF / Excel / .... The input validation of uploaded fil...

CVE-2022-29246 Potential buffer overflow in function DFU upload in Azure RTOS USBX

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features o...

TYPO3 doesn't properly check file extensions

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

CVE-2021-4225 SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload

The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovere...

Design/Logic Flaw

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save method may enable attackers to write files to arbitrary locations outside the designated target folder...

GHSA-X8XX-X82Q-42Q3 Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, sinc...

Unrestricted File Upload

studio-42/elfinder allows unrestricted file uploads. An attacker is able to upload PHP code in a .phar file and obtain arbitrary code execution on the host OS...

Unsecured Proxy

strapi-plugin-upload contains an unsecured proxy. An unauthenticated user is able to access the proxy without any authorization, allowing for access to other protected resources...

CVE-2020-24408

CVE-2020-24408 affects Magento 2.4.0 and 2.3.5p1 (and earlier); it is a stored/persistent XSS in the file upload component that allows an unauthenticated attacker to have their injected JavaScript executed in other users’ contexts once a victim browses the uploaded file. The description in the co...

CVE-2020-10507 ALLE INFORMATION CO., LTD. School Manage System - Security Misconfiguration

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload RCE , that would allow attackers to gain access in the hosting machine...

Design/Logic Flaw

reset/modules/advancedformmakeredit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file...

CVE-2018-14840

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...