WordPress MainWP File Uploader Extension Plugin <= 4.1 is vulnerable to Arbitrary File Deletion

Software MainWP File Uploader Extension Type Plugin Vulnerable versions = 4.1 Fixed in 4.1.1 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-23653 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 7641346095c5 Credits Dave Jong...

FlatPress 跨站脚本漏洞

FlatPress is a Php-based blog building system from the FlatPress community that does not require database support.FlatPress suffers from a cross-site scripting vulnerability that originates in the component XML File Handler/MD File Handler in admin/panels/uploader/admin. The uploader.php file has...

Stored XSS in multiple menus

Description The demo website is affected of stored XSS at multiple menus. Proof of Concept 01 1. Access to the demo website http://demos4.softaculous.com/ 2. Login with admin user they provide, press on menu Uploader, in Uploader tab, try to upload whichever file then choose Media manager tab. 3...

CreativeDream php uploader arbitrary file upload vulnerability

CreativeDream php uploader is an easy-to-use, high-performance file upload script for CreativeDream personal developers. CreativeDream php uploader version 0.3 is vulnerable to arbitrary file uploads, which stem from a lack of valid validation of uploaded files by the application. An attacker cou...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

Design/Logic Flaw

Arbitrary file upload vulnerability in php uploader...

CVE-2022-40721

The CVE-2022-40721 entry corresponds to an Arbitrary file upload vulnerability in CreativeDream php uploader. Multiple connected sources confirm that the issue stems from insufficient validation of uploaded files, enabling remote code execution via uploaded content. The NVD entry assigns a CVSS v...

CVE-2022-40721

Arbitrary file upload vulnerability in php uploader...

PT-2022-25494 · Unknown · Phpuploader

Name of the Vulnerable Software and Affected Versions: php uploader affected versions not specified Description: The issue is related to an arbitrary file upload vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

php uploader 代码问题漏洞

CreativeDream php uploader is an easy-to-use, high-performance file upload script for CreativeDream personal developers. CreativeDream php uploader version 0.3 is vulnerable to arbitrary file uploads, which stem from a lack of valid validation of uploaded files by the application. An attacker cou...

Memberpress Downloads < 1.2.6 - Subscriber+ Arbitrary File Upload

The plugin does not properly check user capabilities in its file uploading AJAX endpoint, relying on WordPress nonces to do so. Unfortunately, the nonce can be leaked by any logged-in users, like subscribers. Since the Uploader library they use does not check file extensions at all, this may lead...

CVE-2022-2695

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2022-2695

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2022-2695

Beaver Builder – WordPress Page Builder (WordPress) is affected by a Stored XSS in the caption parameter added to images via the media uploader, affecting versions up to and including 2.5.5.2. Root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers with Be...

CVE-2022-2695 Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption

The plugin does not sanitise and escape the caption parameter added to images via the media uploader, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks...

Emerson Proficy Machine Edition 路径遍历漏洞

Emerson Proficy Machine Edition is an application from Emerson, Inc. an automation solution. A security vulnerability exists in Emerson Proficy Machine Edition versions 9.80 and earlier, which stems from an easy ZipSlip attack via the uploader program, which allows an attacker to plant a maliciou...

CVE-2022-2426

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators...