CVE-2022-2558: Exposure of Sensitive Information to an Unauthorized Actor

The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations...

Renato 跨站脚本漏洞

Renato is an open source knowledge base platform that uses static Markdown files to power your knowledge base. A security vulnerability exists in Renato version v0.17.0, which originates from an attacker with local access rights can upload a markdown file with malicious JavaScript that can be...

CVE-2021-22646 Ovarro TBox Code Injection

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution...

Cross-site scripting - Stored via upload ".xml" file

Description In file upload function, the server allow upload .xml file with contain some javascript code lead to XSS. Proof of Concept REQUEST POST /?PageTitre/ajaxupload&qqfile=index.xml HTTP/1.1 Host: localhost:8081 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:104.0 Gecko/20100101...

CVE-2022-2299 Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2022-32320

A Cross-Site Request Forgery CSRF in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an uploaded file such as a settings/preferences file...

Ferdi 跨站请求伪造漏洞

Ferdi is software used to combine multiple applications together. A security vulnerability exists in Ferdi version 5.8.1, Ferdium version 6.0.0-nightly.98, which stems from a vulnerability that allows an attacker to read files via uploaded files e.g., settings/preferences files...

Zulip 代码问题漏洞

Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A code issue vulnerability exists in Zulip Server versions 2.1.0 and above, which stems from an error in the...

WordPress plugin nextgen-galery cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2015-1784

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests...

Code injection

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests...

CVE-2015-1785

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests...

WordPress plugin nextgen-galery 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-33009

A stored cross-site scripting XSS vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file...

Kreado Kreasfero 代码问题漏洞

Kreado Kreasfero is an open source CMS from the German company Kreado. A security vulnerability exists in Kreado Kreasfero version 1.5, which stems from an inability to properly clean up files uploaded to the media directory, and can be exploited by an attacker to upload malicious PHP files and...

CVE-2022-1788

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to thi...

PT-2022-14113

Name of the Vulnerable Software and Affected Versions Change Uploaded File Permissions WordPress plugin through 4.0.0 Description The issue is due to missing checks, making the plugin vulnerable to CSRF attacks. This vulnerability can be used to change the file and folder permissions of any folde...

WordPress plugin Change Uploaded File Permissions 跨站请求伪造漏洞

WordPress is a set of blogging platform developed using the PHP language. The WordPress plugin Change Uploaded File Permissions plugin 4.0.0 and earlier versions are vulnerable to cross-site request forgery, which stems from a lack of checks and can be exploited to change the file and folder...

CVE-2022-1788: Cross-Site Request Forgery (CSRF)

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to thi...

Cross site scripting in intelliants/subrion

An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting XSS vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute...