CVE-2022-26645: Unrestricted Upload of File with Dangerous Type

A remote code execution RCE vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function...

PT-2022-5002 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.35.5 and earlier, 1.36.x before 1.36.3, 1.37.x before 1.37.1 Description: The issue is related to Blind Stored XSS via a URL to the Upload Image feature. This could allow a remote attacker to conduct a cross-site scriptin...

CVE-2021-39609

Cross Site Scripting XSS vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function...

CVE-2021-39609

Cross Site Scripting XSS vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function...

CVE-2021-39609: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function...

CVE-2021-34129

LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files, as demonstrated by deleting install.lock in order to reinstall the product in an attacker-controlled manner. This deletion is possible via directory traversal in the uploadImg, oldpic, or imgurl parameter...

Chevereto 3.17.1 Cross Site Scripting

Exploit Title: Chevereto 3.17.1 - Cross Site Scripting Stored Google Dork: "powered by chevereto" Date: 19.04.2021 Exploit Author: Akıner Kısa Vendor Homepage: https://chevereto.com/ Software Link: https://chevereto.com/releases Version: 3.17.1 Tested on: Windows 10 / Xampp Proof of Concept: 1...

CVE-2020-28130: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos under the web root...

CVE-2020-27956

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

CVE-2020-27956: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

CVE-2020-12841: Cross-Site Request Forgery (CSRF)

ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php...

CVE-2020-24195

An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution...

CVE-2020-24195: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution...

CVE-2019-8293

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2019-8293: Unrestricted Upload of File with Dangerous Type

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution...

CVE-2016-10758

PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the imagename parameter...

zzcms cross-site scripting vulnerability (CNVD-2019-13261)

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in the /uploadimgform.php file in ZZCMS version 8.3. A remote attacker can exploit this vulnerability to inject arbitrary HTML or web scripts with the help of the 'noshuiyin' parameter...

CVE-2018-17413

XSS exists in zzcms v8.3 via the /uploadimgform.php noshuiyin parameter...

OFCMS backend ueditor uploadImage file upload vulnerability

OFCMS is a content management system based on Java technology. A backend ueditor uploadImage file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files without taking into account the file.jsp::$DATA of the...

CVE-2019-9608

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...