CVE-2023-48114

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name...

WordPress Plugin Drag and Drop Multiple File Upload for WooCommerce Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Lightxun IPTV Gateway Code Issue Vulnerability

Lightxun IPTV Gateway is a gateway product from China Lightxun Technology Lightxun. A code issue vulnerability exists in Lightxun IPTV Gateway, which originates from some unknown processing in /ZHGXTV/index.php/admin/index/webuploadtemplate.html, which leads to unrestricted uploads via the...

The vulnerability of OMICARD’s marketing mailing system lies in the improper restriction on the name of the path to the restricted catalog. This allows attackers to bypass the authentication process and upload arbitrary files.

The vulnerability of OMICARD’s marketing email system is related to incorrect restrictions on the path name to the restricted catalog during the processing of the FileName parameter. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures and upload arbitrary...

SUSE-SU-2023:4939-1 Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues: - CVE-2023-46118: Introduce HTTP request body limit for definition uploads bsc1216582...

PT-2023-19325 · Woorockets · Woorockets Corsa

Name of the Vulnerable Software and Affected Versions: WooRockets Corsa versions 1.5 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability. This allows for the upload of files with potentially dangerous types, which could lead to securit...

PT-2023-20395 · Unknown · Zendrop – Global Dropshipping

Name of the Vulnerable Software and Affected Versions: Zendrop – Global Dropshipping versions 1.0.0 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Zendrop – Global Dropshipping. This allows for the upload of files with potentiall...

CVE-2023-46263

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution...

Wavelink Avalanche Security Vulnerability

Wavelink Avalanche is a mobile device management system from Wavelink, Inc. in the United States. A security vulnerability exists in Wavelink Avalanche version 6.4.1 and prior versions, which stems from not limiting the number of uploads of dangerous types of files. An attacker can exploit the...

PT-2023-8581 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions 6.4.1 and below Description: The issue is related to an unrestricted upload of files with dangerous types, which could allow a remote attacker to achieve remote code execution. This vulnerability can be exploited by...

Wavelink Avalanche Security Vulnerability

Wavelink Avalanche is a mobile device management system from Wavelink, Inc. in the United States. A security vulnerability exists in Wavelink Avalanche version 6.4.1 and earlier versions, which stems from not limiting the number of uploads of dangerous types of files. An attacker can exploit the...

WordPress Plugin Vrm 360 3D Model Viewer Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

KodExplorer Code Issue Vulnerability

KodExplorer is a web file manager by the individual developer warlee. A code issue vulnerability exists in KodExplorer version 4.51.03, which stems from operations on parameterized paths/files that can lead to unrestricted uploads...

CVE-2023-48394

Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

CVE-2023-6826

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

Input validation

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

CVE-2023-6827

The CVE concerns the WordPress plugin Essential Real Estate (

CVE-2023-6827 Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload

The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above...

CVE-2023-6826 E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

CVE-2023-6826 E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...