1435 matches found
WSO2 API Manager SynapseArtifactUploaderAdmin Unrestricted File Upload Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WSO2 API Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the SynapseArtifactUploaderAdmin endpoint, which listens on TCP port 9443 by default. The...
WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.6.9...
MAL-2024-11829 Malicious code in imgur-uploader-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e12db7b7de507126d4fa046e84a7acb1e502c87e639c69d90159cd396bed2b84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in imgur-uploader-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e12db7b7de507126d4fa046e84a7acb1e502c87e639c69d90159cd396bed2b84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11162 Malicious code in @hmp/h-image-uploader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 393baa73357f44a746ebe45eb2d74ed46234f46c3cfc528b4d221c1e3f945626 The OpenSSF Package Analysis project identified '@hmp/h-image-uploader' @ 1.0.1 npm as malicious. It is considered malicious because: - The...
Malicious code in @hmp/h-image-uploader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 393baa73357f44a746ebe45eb2d74ed46234f46c3cfc528b4d221c1e3f945626 The OpenSSF Package Analysis project identified '@hmp/h-image-uploader' @ 1.0.1 npm as malicious. It is considered malicious because: - The...
CVE-2024-8873 PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting
The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2024-8873 PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting
The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrar...
WordPress plugin PeproDev WooCommerce Receipt Uploader 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Cross-site Scripting (XSS)
Overview sylius/sylius is a platform for PHP, based on Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a malicious SVG file, in ImageUploader.php. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects”...
Malicious code in byted-uploader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18d8716f381fe415e0a60d91795ecdf5fd7e914d91f66bbee21945a374aa409f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10304 Malicious code in byted-uploader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18d8716f381fe415e0a60d91795ecdf5fd7e914d91f66bbee21945a374aa409f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-VGXQ-6RCF-QWRW angular-base64-upload vulnerable to unauthenticated remote code execution
angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the...
WordPress AVIF & SVG Uploader plugin <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability
Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin AVIF & SVG Uploader versions = 1.1.0...
WordPress plugin AVIF & SVG Uploader 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
WordPress AVIF & SVG Uploader Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)
Software AVIF & SVG Uploader Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9060 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6e662df81c43 Credits Francesco Carlucci...
PT-2024-39291 · WordPress · Peprodev Woocommerce Receipt Uploader
Name of the Vulnerable Software and Affected Versions: PeproDev WooCommerce Receipt Uploader plugin for WordPress versions up to, and including, 2.6.9 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...
CVE-2024-44794
A cross-site scripting XSS vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the errordescription parameter...
ShopXO Code Issues Vulnerabilities
ShopXO is an open source enterprise-level open source e-commerce system from ShopXO Inc. A code issue exists in ShopXO version 6.1.0 and earlier versions, which is caused by a server-side request forgery vulnerability in the source parameter of the extend/base/Uploader.php file...