CVE-2024-9985

Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server...

CVE-2024-9985

CVE-2024-9985 involves the Ragic Enterprise Cloud Database. The vulnerability arises from improper validation of uploaded file types, enabling attackers with regular privileges to upload a webshell and execute arbitrary code on the remote server. Multiple sources (NVD and national/ regional advis...

PT-2024-39062 · WordPress · File Manager Pro

Name of the Vulnerable Software and Affected Versions: File Manager Pro plugin for WordPress versions up to, and including, 8.3.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'mk file folder manager' ajax action. This allows...

VulnCheck KEV: CVE-2016-15042

The Frontend File Manager versions 4.0, N-Media Post Front-end Form versions 1.1 plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the nmfilemanageruploadfile and nmpostfrontuploadfile AJAX actions. This makes it possible for unauthenticated...

WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Analyse Uploads versions = 0.5...

WordPress Analyse Uploads Plugin <= 0.5 is vulnerable to Arbitrary File Deletion

Software Analyse Uploads Type Plugin Vulnerable versions = 0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49253 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 7d31a27cc3f2 Credits stealthcopter Required privilege...

CVE-2024-9137: Missing Authentication for Critical Function

The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise...

The library’s vulnerability in converting files to the base64 format for uploading files to the Angular Base64 Upload web application, allowing a hacker to execute arbitrary code.

The vulnerability of the library for converting files to the base64 format, which is used to upload files to the web application’s server, relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute...

PT-2024-6816 · Moxa · Moxa Nat-102 Oncell G4302-Lte4 +5

Name of the Vulnerable Software and Affected Versions: Moxa EDR-8010 versions affected versions not specified Moxa EDR-G9004 versions affected versions not specified Moxa EDR-G9010 versions affected versions not specified Moxa EDR-G1002-BP versions affected versions not specified Moxa NAT-102...

CVE-2024-9904

CVE-2024-9904 affects 07FLYCMS, 07FLY-CMS and 07FlyCRM up to version 1.2.0. The flaw is in the function pictureUpload under /admin/File/pictureUpload, where manipulating the file argument enables unrestricted remote upload. Exploitation has been publicly disclosed; multiple sources corroborate th...

PT-2024-37998 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version 9.8 Description: A Denial of Service DOS attack can be performed when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously...

CVE-2024-9756

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on the wcoaaddattachment AJAX action in versions 2.0 to 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-9756

The Order Attachments for WooCommerce plugin (WordPress) is affected by CVE-2024-9756 due to a missing capability check on the wcoa_add_attachment AJAX action in versions 2.0–2.4.1. This allows authenticated users with subscriber-level access and above to upload limited file types. Exploitation d...

CVE-2024-9656

The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

SUSE CVE-2024-47164

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

WordPress plugin Order Attachments for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-39316 · WordPress · Category Icon

Name of the Vulnerable Software and Affected Versions: Category Icon plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticate...

PT-2024-39744 · WordPress · Mynx Page Builder

Name of the Vulnerable Software and Affected Versions: Mynx Page Builder plugin for WordPress versions up to, and including, 0.27.8 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CVE-2024-9656: Improper Neutralization of Input During Web Page Generation

The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

angular-base64-upload vulnerable to unauthenticated remote code execution

angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the...