Qi Blocks < 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting

Description The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

Wbcom Designs - Custom Font Uploader < 2.4.0 - Missing Authorization to Font Deletion

Description The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cfudeletecustomfont' function in all versions up to, and including, 2.3.4. This makes it possible for authenticated attackers, with...

CVE-2024-35636 WordPress Uploadcare File Uploader and Adaptive Delivery plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery beta uploadcare.This issue affects Uploadcare File Uploader and Adaptive Delivery beta: from n/a through 3.0.11...

WordPress Uploadcare File Uploader and Adaptive Delivery plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Mikage.K Patchstack Alliance in WordPress Plugin Uploadcare File Uploader and Adaptive Delivery beta versions = 3.0.11...

WordPress Uploadcare File Uploader and Adaptive Delivery (beta) Plugin <= 3.0.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Uploadcare File Uploader and Adaptive Delivery beta Type Plugin Vulnerable versions = 3.0.11 Fixed in 3.1.0 OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-35636 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7af925782e5b...

Importance of Scanning Files on Uploader Applications

Delve into the crucial practice of file scanning within uploader applications, and learn defensive measures to safeguards against malicious threats like malware...

CVE-2023-23656

Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from n/a through 4.1...

CVE-2023-23656 WordPress MainWP File Uploader Extension Plugin <= 4.1 - Unauthenticated Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from n/a through 4.1...

PT-2024-11991 · Mainwp · Mainwp File Uploader Extension

Name of the Vulnerable Software and Affected Versions: MainWP File Uploader Extension versions through 4.1 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the MainWP File Uploader Extension. Recommendations: For versions through 4.1, update t...

WordPress Plugin File Uploader 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2024-0864

CVE-2024-0864 affects Laragon when the Simple Ajax Uploader plugin is enabled. The vulnerability arises from improper input validation in a file_upload.php example that can enable remote code execution (RCE). By default, Laragon is not vulnerable unless the plugin is used. Connected sources (Red ...

CVE-2024-0864 RCE in Laragon

Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution RCE attack via an improper input validation in a fileupload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned...

CVE-2024-0864 RCE in Laragon

Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution RCE attack via an improper input validation in a fileupload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned...

PT-2024-15874 · Laragon · Laragon +1

Name of the Vulnerable Software and Affected Versions: Laragon affected versions not specified Description: The issue allows for a remote code execution RCE attack via an improper input validation in a file upload.php file, which serves as an example. This occurs when the Simple Ajax Uploader...

Liferay Portal vulnerable to Denial of Service

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, whic...

GHSA-29XX-FHFF-36M7 Liferay Portal vulnerable to Denial of Service

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, whic...

CVE-2024-26265

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, whic...

Design/Logic Flaw

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, whic...

CVE-2024-26265

CVE-2024-26265 affects the Image Uploader module in Liferay Portal (7.2.0–7.4.3.15 and older unsupported) and Liferay DXP (7.4 pre-update 16, 7.3 pre-update 4, 7.2 pre-fix pack 19). The root cause is reliance on a request parameter to cap upload size; remote authenticated users can modify the max...

Liferay Portal and Liferay DXP Security Vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...