PT-2022-16525

Name of the Vulnerable Software and Affected Versions URVE Web Manager affected versions not specified Description A critical issue has been found in URVE Web Manager, affecting an unknown part of the file kreator.html5/img upload.php. The manipulation leads to unrestricted upload, requiring acce...

PT-2022-16530

Name of the Vulnerable Software and Affected Versions URVE Web Manager affected versions not specified Description A critical vulnerability was found in URVE Web Manager, affecting the file internal/collector/upload.php. The manipulation leads to unrestricted upload, requiring access to the local...

CVE-2022-2419: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has be...

CVE-2022-30508

DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter...

CVE-2022-30508

DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter...

Arbitrary file deletion

DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter...

CVE-2022-30508

DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter...

CVE-2022-30508

DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter...

CVE-2022-30508

CVE-2022-30508 affects DedeCMS v5.7.93, with an arbitrary file deletion vulnerability in upload.php exploitable via the delete parameter. The Red Hat/NVD/PRION/CVE records all reiterate the same description; exploitation details and a confirmed fix are not provided in the connected documents. PT-...

CVE-2022-30508: Improper Limitation of a Pathname to a Restricted Directory

DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter...

GHSA-VWH5-78JC-HPJX SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php

A cross-site scripting XSS vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter...

SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php

A cross-site scripting XSS vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter...

Safe SVG < 1.9.10 - SVG Sanitisation Bypass

The sanitisation step of the plugin can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent mainly XSS, but depending on further use of uploaded SVG...

CVE-2021-35414

Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php...

Sql injection

Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php...

CVE-2021-35414

Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php...

PT-2021-20908

Name of the Vulnerable Software and Affected Versions: Chamilo LMS version v1.11.x Description: The issue is related to a SQL injection via the doc parameter in the main/plagiarism/compilatio/upload.php file. This allows for potential exploitation. No information is provided about the estimated...

CVE-2021-35414: Improper Neutralization of Special Elements used in an SQL Command

Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php...

CVE-2020-23572

CVE-2020-23572 concerns BEESCMS v4.0, where an arbitrary file upload vulnerability in the /admin/upload.php component enables attackers to execute arbitrary code via a crafted image file. Multiple sources (NVD, Red Hat, CNVD, CVE listings) confirm the issue and its impact; CVSSv3.1 base score is ...

CVE-2020-23572: Unrestricted Upload of File with Dangerous Type

BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file...