Malicious code in field-upload-tool (npm)

Source: amazon-inspector 17402ad5019d1d433139ce2652d18d2493d87acfd1ede435a94c87eb421f25b1 On every npm install, the package's postinstall lifecycle script in package.json spawns a detached, unref'd Node process that decodes a base64-encoded payload via node -e Buffer.from...,'base64'.toString and...

PT-2026-60897

Name of the Vulnerable Software and Affected Versions meta-ads-mcp version 1.0.113 Description An unauthenticated remote attacker can perform a Server-Side Request Forgery SSRF when the server is deployed using the streamable-http transport. The upload ad image tool accepts an image url parameter...

CVE-2026-59807 Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...

CVE-2026-43989

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the uploadwasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is...

EUVD-2026-23811

A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the function Upload of the file FileTool.java of the component File Upload Endpoint. The manipulation of the argument Type results in path traversal. The attack may be launched remotely. The exploit has...

EUVD-2006-7115

Malware in sbrugna...

EUVD-2021-0644

Malware in sbrugna...

CarrierWave cross-site scripting vulnerabilities

Mshibuya CarrierWave is an upload tool from the Mshibuya Personal Organization in the United States. It provides a simple and extremely flexible way to upload files from Ruby applications. A security vulnerability exists in CarrierWave. An attacker could exploit this vulnerability to perform...

BIT-MOODLE-2020-25701

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3....

CVE-2023-5547 Moodle: xss risk when previewing data in course upload tool

The course upload preview contained an XSS risk for users uploading unsafe data...

CVE-2020-25701

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3....

CVE-2020-25701

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3....

Unspecified vulnerability in upload-image-with-ajax

upload-image-with-ajax is an image file upload tool. A security vulnerability exists in upload-image-with-ajax v1.0, which is caused by a logic error in the code. The vulnerability can be exploited to upload arbitrary files to the web root directory and execute code...

[SECURITY] [DSA 3796-2] sitesummary regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3796-2 [email protected] https://www.debian.org/security/ Sebastien Delafond March 20, 2017 https://www.debian.org/security/faq -...

PT-2016-7706

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 11.51.11007.2 Description A vulnerability in the Cisco Unified Reporting upload tool could allow an unauthenticated, remote attacker to modify arbitrary files on the file system. Recommendations For...

PHP Upload Tool 1.0 - Arbitrary File Upload and Directory Traversal Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/21150/info PHP Upload Tool is prone to an arbitrary file-upload vulnerability and a directory-traversal vulnerability. These issues occur because the application fails to sanitize user-supplied data. An attacker could...

CVE-2006-7133

CVE-2006-7133 describes a directory traversal vulnerability in Upload Tool for PHP 1.0, specifically in upload/bin/download.php. Remote attackers can read arbitrary files by manipulating the filename parameter with “..” sequences or absolute pathnames. The vulnerability affects Upload Tool for PH...

CVE-2006-7133

Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via 1 ".." sequences or 2 absolute pathnames in the filename parameter...

CVE-2006-7134: Undefined Security Weakness

Unrestricted file upload vulnerability in mainuser.php in Upload Tool for PHP 1.0 allows remote attackers to upload and execute arbitrary files with executable extensions such as .php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...

CVE-2006-7133: Undefined Security Weakness

Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via 1 ".." sequences or 2 absolute pathnames in the filename parameter...