CVE-2023-25654 baserCMS File Uploader Remote Code Execution (RCE) vulnerability

baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution RCE Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch...

CVE-2023-1558

CVE-2023-1558 affects Simple and Beautiful Shopping Cart System 1.0. The vulnerability is in the uploadera.php component and enables unrestricted file upload, with remote initiation possible. Multiple connected sources confirm the issue and describe it as a critical vulnerability exploiting an up...

SUSE CVE-2010-4208

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader/assets/uploader.swf...

SUSE CVE-2012-5882

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208...

CVE-2022-39811

Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassin...

WordPress MainWP File Uploader Extension Plugin <= 4.1 is vulnerable to Arbitrary File Upload

Software MainWP File Uploader Extension Type Plugin Vulnerable versions = 4.1 Fixed in 4.1.1 OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2023-23656 Patch priority High CVSS severity High 10 Developer Claim ownership PSID f49d8364bda5 Credits Dave Jong...

WordPress MainWP File Uploader Extension Plugin <= 4.1 is vulnerable to Arbitrary File Deletion

Software MainWP File Uploader Extension Type Plugin Vulnerable versions = 4.1 Fixed in 4.1.1 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-23653 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 7641346095c5 Credits Dave Jong...

WordPress MainWP Article Uploader Extension Plugin <= 4.0.2 is vulnerable to Broken Access Control

Software MainWP Article Uploader Extension Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23742 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e674bdb18c0f Credits Dave Jong...

FlatPress 跨站脚本漏洞

FlatPress is a Php-based blog building system from the FlatPress community that does not require database support.FlatPress suffers from a cross-site scripting vulnerability that originates in the component XML File Handler/MD File Handler in admin/panels/uploader/admin. The uploader.php file has...

Stored XSS in multiple menus

Description The demo website is affected of stored XSS at multiple menus. Proof of Concept 01 1. Access to the demo website http://demos4.softaculous.com/ 2. Login with admin user they provide, press on menu Uploader, in Uploader tab, try to upload whichever file then choose Media manager tab. 3...

CreativeDream php uploader arbitrary file upload vulnerability

CreativeDream php uploader is an easy-to-use, high-performance file upload script for CreativeDream personal developers. CreativeDream php uploader version 0.3 is vulnerable to arbitrary file uploads, which stem from a lack of valid validation of uploaded files by the application. An attacker cou...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

Design/Logic Flaw

Arbitrary file upload vulnerability in php uploader...

CVE-2022-40721

The CVE-2022-40721 entry corresponds to an Arbitrary file upload vulnerability in CreativeDream php uploader. Multiple connected sources confirm that the issue stems from insufficient validation of uploaded files, enabling remote code execution via uploaded content. The NVD entry assigns a CVSS v...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

php uploader 代码问题漏洞

CreativeDream php uploader is an easy-to-use, high-performance file upload script for CreativeDream personal developers. CreativeDream php uploader version 0.3 is vulnerable to arbitrary file uploads, which stem from a lack of valid validation of uploaded files by the application. An attacker cou...

PT-2022-25494 · Unknown · Phpuploader

Name of the Vulnerable Software and Affected Versions: php uploader affected versions not specified Description: The issue is related to an arbitrary file upload vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Memberpress Downloads < 1.2.6 - Subscriber+ Arbitrary File Upload

The plugin does not properly check user capabilities in its file uploading AJAX endpoint, relying on WordPress nonces to do so. Unfortunately, the nonce can be leaked by any logged-in users, like subscribers. Since the Uploader library they use does not check file extensions at all, this may lead...