Safe Software FME Server 路径遍历漏洞

Safe Software FME Server is a web-based data conversion application from Safe Software Canada Inc. It is used to automate data and application integration workflows in a code-free environment. Safe Software FME Server suffers from a path traversal vulnerability that stems from a validation check...

Library Management System With QR Code 1.0 Shell Upload

Title: Library Management System with QR code AttendanceFile Upload RCE Author: Ashish Kumar https://www.linkedin.com/in/ashish-kumar-0b65a3184 Date: 27.06.2022 Vendor: https://www.sourcecodester.com/users/kingbhob02 Software:...

CVE-2022-0863

The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution...

Open Forms 代码问题漏洞

Open Forms is Open Formulieren open source an intelligent dynamic form . Used to quickly create powerful and intelligent forms exposed through the API . Open Forms versions prior to 1.1.1 have a code issue vulnerability that stems from insufficient input validation of uploaded files...

CVE-2021-35532 Firmware upload verification bypass in TXpert Hub CoreTec 4

A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product...

PT-2022-10468 · Hitachi Energy · Hitachi Energy Txpert Hub Coretec 4

Name of the Vulnerable Software and Affected Versions: Hitachi Energy TXpert Hub CoreTec 4 versions 2.0.0 through 2.2.1 Description: A vulnerability exists in the file upload validation part of the Hitachi Energy TXpert Hub CoreTec 4 product. This issue allows an attacker or malicious agent who...

Wedding Management System 代码问题漏洞

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. The vulnerability is caused by a lack of validation of the uploaded files in the photosedit.php page, which could be exploited to upload malicious files and remotely execute...

MaxBoard 跨站脚本漏洞

Max Yi MaxBoard is a CMS Content Management System or Web framework from Max Yi Korea. It helps to make website creation and site management easier, and can be easily and conveniently used to build the back-end of an application. A cross-site scripting vulnerability exists in MaxBoard versions...

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

The plugin does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code PoC Edit/add a Characteristics /wp-admin/admin.php?option=comvikbooking=carat and upload a fake GIF with PHP code in it as a...

Western Digital My Cloud 后置链接漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A backlink vulnerability exists in Western Digital My Cloud OS 5 due to insufficient file validation during file uploads in the native language combination provided by SMB and AFP in its default configuration. A...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The vulnerability exists due to lack of validations in the file upload in the netItemStackToCore function of TypeConverter.php which allows an attacker to cause an application crash...

Microweber 跨站脚本漏洞

Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber is vulnerable to a cross-site scripting vulnerability that stems from a file upload filter that fails to properly validate input parameters, which could be exploited to construct a stored XSS,...

Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager

This affects the package unisharp/laravel-filemanager prior to version 2.6.2. The upload function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload...

GHSA-364W-9G92-3GRQ Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

Withdrawn This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue. Original CVE based description Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP...

Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

Withdrawn This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue. Original CVE based description Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP...

Input validation

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for...

OPENSUSE-SU-2021:1424-1 Security update for civetweb

This update for civetweb fixes the following issues: Version 1.15: boo1191938 / CVE-2020-27304: missing uploaded filepath validation in the default form-based file upload mechanism New configuration for URL decoding Sanitize filenames in handle form Example “embeddedc.c”: Do not overwrite files...

ZOHO ManageEngine ADManager Plus 代码问题漏洞

Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A remote code execution vulnerability exists in Zoho ManageEngine ADManager Plus Build 7111, which stems from not properly validating file uploads in the PasswordExpiry interface and can...

ZOHO ManageEngine ADManager Plus 代码问题漏洞

Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A remote code execution vulnerability exists in Zoho ManageEngine ADManager Plus Build 7111, which stems from not properly validating file uploads in the Personalization interface and ca...

CVE-2021-38484

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of malicious files to the server, which may allow an attacker, acting as an administrator, to upload malicious files. This could result in cross-site scriptin...