157 matches found
PT-2023-32866 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A vulnerability was found in the software, affecting unknown code of the file /upload/uploadFile. The manipulation of the file argument leads to unrestricted upload. The attack can be initiated remotely...
CVE-2023-6576
A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php of the component HTTP POST Request Handler. The manipulation of the argument fileupload leads to unrestricted upload. The attack can ...
Remote Code Execution (RCE)
guest-entries is vulnerable to Remote Code Execution RCE. The vulnerability is due to the uploadFile function in GuestEntryController.php, as there are no checks for the file type being uploaded. This allows attackers to upload and potentially execute malicious PHP files...
The vulnerability of the `desktop_app/file.ajax.php?action=uploadfile` component in the main module of the Bitrix24 business management service allows a attacker to cause a service failure.
The vulnerability of the desktopapp/file.ajax.php?action=uploadfile component in the main module of the Bitrix24 business management service is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service...
Beijing Baichuo Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Code Issue Vulnerability
Beijing Baichuo Smart S45F Multi-Service Secure Gateway Intelligent Management Platform is a Multi-Service Secure Gateway Intelligent Management Platform from Beijing Baichuo, China. Byzro Networks Smart S45F Multi-Service Secure Gateway Intelligent Management Platform 20230928 and earlier versio...
Vulnerability of the /Tool/uploadfile.php script in D-Link DAR-8000 and DAR-7000 router microprogramming software, allowing attackers to execute arbitrary commands
The vulnerability of the /Tool/uploadfile.php script in D-Link’s DAR-8000 and DAR-7000 router microprogramming systems relates to the ability to download files of a malicious nature without limitation. Exploiting this vulnerability could allow an attacker to execute arbitrary commands remotely...
PT-2023-5604 · D Link · D-Link Dar-8000 +1
Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 and DAR-8000 up to 20151231 Description: A critical vulnerability affects the file /Tool/uploadfile.php, allowing unrestricted upload through the manipulation of the file upload argument. This can be initiated remotely,...
CVE-2023-3625
A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This vulnerability affects unknown code of the file /Duty/AjaxHandle/Write/UploadFile.ashx of the component Duty Write-UploadFile. The manipulation ...
PT-2023-25494 · Suncreate · Suncreate Mountain Flood Disaster Prevention Monitoring/Early Warning System
Name of the Vulnerable Software and Affected Versions: Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706 Description: A critical issue was discovered, affecting the /Duty/AjaxHandle/Write/UploadFile.ashx file of the Duty Write-UploadFile component. Th...
The vulnerability of the uploadFile function in the D-View 8 network device management platform allows a hacker to create arbitrary files.
The vulnerability of the uploadFile function in the D-View 8 network device management platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to create arbitrary files remotely...
Information Disclosure
github.com/answerdev/answer is vulnerable to Information Disclosure. The vulnerability exists due to improper validation in the filePath attribute in the uploadFile function of upload.go, which allows an attacker to access the uploaded image and extract the EXIF data...
KiteCMS 代码问题漏洞
KiteCMS is a website CMS. A security vulnerability exists in KiteCMS v.1.1. An attacker can exploit this vulnerability to execute arbitrary code via the uploadFile function...
PT-2023-12173 · Kitecms · Kitecms
Name of the Vulnerable Software and Affected Versions: KiteCMS version 1.1 Description: A File Upload issue allows a remote attacker to execute arbitrary code via the uploadFile function. This enables the attacker to potentially gain control over the system. Recommendations: For KiteCMS version...
CVE-2023-1484
A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this...
PT-2023-17021 · Xzjie Cms · Xzjie Cms
Name of the Vulnerable Software and Affected Versions: xzjie cms versions up to 1.0.3 Description: A critical issue affects the processing of the file "/api/upload". The manipulation of the uploadFile argument leads to unrestricted upload. The attack can be initiated remotely. Recommendations: Fo...
xzjie cms 代码问题漏洞
xzjie cms is xzjie individual developers of the cloud tower guest - cabin content publishing system. A code issue vulnerability exists in xzjie cms 1.0.3 and earlier versions, which stems from a problem with files/api/upload, where manipulation of the parameter uploadFile can lead to unrestricted...
GHSA-F93F-55C2-8C89 Casdoor arbitrary file deletion vulnerability via uploadFile function
Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function...
Casdoor arbitrary file deletion vulnerability via uploadFile function
Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function...
