1435 matches found
CVE-2014-5324
N-Media file uploader plugin for WordPress is vulnerable prior to version 3.4. An unrestricted file upload allows remote authenticated users with Author privileges to store a file and execute arbitrary PHP code on the server. Impact is arbitrary code execution with partial confidentiality/integri...
N-Media file uploader vulnerability in handling uploaded files
Overview N-Media file uploader is a plugin for WordPress. N-Media file uploader contains a vulnerability CWE-264 in the way it handles uploaded files. As a result, an arbitrary PHP script which is uploaded may be executed. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC...
JVN#87863382: N-Media file uploader vulnerability in handling uploaded files
N-Media file uploader is a plugin for WordPress. N-Media file uploader contains a vulnerability CWE-264 in the way it handles uploaded files. As a result, an arbitrary PHP script which is uploaded may be executed. Impact A user with "Author" privileges and above may execute an arbitrary command o...
Flash Uploader <= 3.1.2 - Arbitrary Comm& Execution
The WordPress Flash Uploader WordPress plugin was affected by an Arbitrary Comm& Execution security vulnerability...
SA-CONTRIB-2014-084 - Avatar Uploader - Information Disclosure
The Avatar Uploader enables you to upload user pictures in a user-friendly way, like Quora and Facebook. The module doesn't sufficiently check the picture path when a user crops the picture in the uploader panel allowing a malicious user to make specially crafted requests to obtain sensitive serv...
WordPress N-Media file uploader Plugin <= 3.3 - Unrestricted File Upload
Because of this vulnerability, authenticated users can execute arbitrary PHP code by leveraging Author privileges to store a file. Solution Update the plugin...
CVE-2011-2944
SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...
CVE-2011-2944
SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...
Sql injection
SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...
CVE-2011-2944
CVE-2011-2944 affects MegaLab The Uploader prior to version 2.0.5. The login.php handling allows a SQL injection via the username parameter, enabling remote attackers to execute arbitrary SQL commands. The NVD record lists a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complex...
CVE-2011-2944
SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter...
Nuance - Valums Uploader Shell Upload Exploit
The nuance WordPress theme was affected by a Valums Uploader Shell Upload Exploit security vulnerability...
LightSpeed - Valums Uploader Shell Upload Exploit
The lightspeed WordPress theme was affected by a Valums Uploader Shell Upload Exploit security vulnerability...
WordPress SB Uploader 3.9 - Arbitrary File Upload
The SB Uploader WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
N-Media File Uploader < 2.0 Arbitrary File Upload
The Frontend File Manager Plugin WordPress plugin was affected by security vulnerability...
File Uploader - PHP File Upload
The wp-file-uploader WordPress plugin was affected by a PHP File Upload security vulnerability...
Font Uploader 1.2.4 - Arbitrary File Upload
The font-uploader WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
Uploader 1.0.0 - wp-content/plugins/uploader/views/notify.php num Parameter XSS
The uploader WordPress plugin was affected by a wp-content/plugins/uploader/views/notify.php num Parameter XSS security vulnerability...
WordPress Contact Form 7 Plugin <= 3.5.2 - Remote Code Execution
Because of this vulnerability, attackers with admin access add uploader tag into contact form at the site and use it for CE via AFU attack. Solution Update the plugin...