PT-2019-7788

Name of the Vulnerable Software and Affected Versions Tevolution plugin versions prior to 2.3.0 Description The issue allows for arbitrary file upload through "single upload.php" or "single-upload.php". Recommendations For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the...

Design/Logic Flaw

A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because...

PT-2019-5818

Name of the Vulnerable Software and Affected Versions MicroDigital N-series cameras with firmware through 6400.0.8.5 Description The issue is related to a buffer overflow in memory, which can be exploited by an attacker to cause a denial of service. This can be achieved by uploading a file with a...

CVE-2019-14706: Improper Restriction of Operations within the Bounds of a Memory Buffer

A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because...

CVE-2019-14315

A cross-site scripting XSS vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter...

CVE-2019-14315

The CVE-2019-14315 entry documents a cross-site scripting (XSS) vulnerability in SunHater KCFinder where upload.php is affected in versions 3.20-test1, 3.20-test2, 3.12 and earlier. The root cause involves improper handling of input that allows an attacker to inject arbitrary web script or HTML v...

CVE-2019-14315: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter...

PT-2019-13603

Name of the Vulnerable Software and Affected Versions SunHater KCFinder versions 3.20-test1, 3.20-test2, 3.12, and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter in the upload.php file...

PT-2019-13117

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions 1.11.8 and 2.x Description The issue allows remote code execution through an unauthenticated file upload feature in lp upload.php. It extracts a ZIP archive before checking its content, and once extracted, does not check...

CVE-2019-12170

ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/core/backups/upload.php aka backup component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...

CVE-2019-12170: Unrestricted Upload of File with Dangerous Type

ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/core/backups/upload.php aka backup component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...

Exploit for Path Traversal in Ninjaforms Ninja_Forms_File_Uploads

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension...

CVE-2019-10869: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress when the Uploads add-on is activated. This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php aka upload/submit page name and...

PT-2019-12422

Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue allows a remote normal registered user to upload arbitrary files, potentially including backdoor files, to control the server. This is due to a vulnerability in the /fileman/php/upload.php endpoint...

CVE-2019-11615: Unrestricted Upload of File with Dangerous Type

/fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability. A remote normal registered user can use this vulnerability to upload backdoor files to control the server...

CVE-2019-11446: Unrestricted Upload of File with Dangerous Type

An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase a...

PT-2019-12311

Name of the Vulnerable Software and Affected Versions ATutor versions prior to 2.2.5 Description An issue in ATutor allows a user with teacher privileges to run commands on the server. The File Manager's Upload Files section contains an arbitrary file upload vulnerability via the "upload.php"...

PT-2019-12065

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 3.0.23 Description The issue allows an attacker to traverse the file system and access files, as well as execute code. This is achieved through the includes/fields/upload.php page, specifically via the name...

CVE-2018-20526

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php...

CVE-2018-20526

The Roxy Fileman open-source file browser version 1.4.5 is vulnerable to unrestricted file upload via the upload.php file. An attacker can exploit this flaw to upload shell code or other malicious files to the server without authentication. Successful exploitation may lead to remote code executio...