PT-2023-35500

Name of the Vulnerable Software and Affected Versions git-annex versions prior to 6.20160419 Description A bug in git-annex exposed the checksum of annexed files to encrypted special remotes, which should not have access to this information. This issue occurred when resuming uploads to the...

PT-2023-25037 · Papercut · Papercut Ng

Name of the Vulnerable Software and Affected Versions: PaperCut NG versions 22.0.12 and prior Description: An authentication bypass exists that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and...

Dahua Smart Parking Management 代码问题漏洞

Dahua Smart Parking Management is a parking solution from Dahua, China. A code issue exists in Dahua Smart Parking Management versions prior to 20230713, which stems from unknown code in the file /emap/devicePointaddImgIco?hasSubsystem=true, which results in unrestricted uploads via the parameter...

Chengdu Flash Flood Disaster Monitoring and Warning System 代码问题漏洞

Chengdu Flash Flood Disaster Monitoring and Warning System is a flash flood disaster monitoring and warning system in Chengdu. A code issue exists in version 2.0 of the Chengdu Flash Flood Disaster Monitoring and Warning System where an incorrect operation of the parameter userFile can lead to...

House Rental and Property Listing 代码问题漏洞

House Rental and Property Listing is a system developed in PHP, JavaScript, Bootstrap, CSS and MySQL database. It makes it easy for users to find the right house or property for rent. A code issue exists in SourceCodester House Rental and Property Listing System version 1.0 where a vulnerability...

Chengdu Flash Flood Disaster Monitoring and Warning System 代码问题漏洞

Chengdu Flash Flood Disaster Monitoring and Warning System is a flash flood disaster monitoring and warning system in Chengdu. A code issue exists in Chengdu Flash Flood Disaster Monitoring and Warning System version 2.0, the vulnerability stems from the parameter file in the file...

PT-2023-4778 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator plugin for WordPress versions up to, and including, 1.24.6 Description: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server ...

EasyAdmin8 代码问题漏洞

EasyAdmin8 is a server administration suite for Blumlaut individual developers. A code issue vulnerability exists in EasyAdmin8 version 2.0.2.2, which stems from the fact that the file /admin/index/index.html/admin/mall.goods/index.html causes unrestricted uploads...

Bug Finder Foody Friend 代码问题漏洞

Bug Finder Foody Friend is a SAAS-based web application ordering bot from Bug Finder, Inc. A code issue vulnerability exists in Bug Finder Foody Friend version 1.0, which stems from the parameter profilepicture in the file /user/profile that causes unrestricted uploads...

WordPress Protect Uploads with Login – Protect Your Uploads Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Protect Uploads with Login – Protect Your Uploads Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e35b81720c5e Credits Rafie...

Fides Webserver Vulnerable to SVG Bomb File Uploads

Impact The Fides webserver is vulnerable to a type of Denial of Service DoS attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs similar to a billion laughs attack, causing resource exhaustion in Admin UI browser tabs and creating a persistent denial...

CVE-2023-35189

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software Drag and Drop & Multiple Image Uploads With Preview For WPForms Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

PT-2023-25991

Name of the Vulnerable Software and Affected Versions Fides versions 2.11.0 through 2.15.1 Description The Fides webserver is vulnerable to a type of Denial of Service DoS attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs, causing resource...

WordPress azw woocommerce file uploads Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software azw woocommerce file uploads Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID eff1363b8435 Credits Rafie Muhammad...

Admidio 代码问题漏洞

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A code issue vulnerability exists in versions prior to admidio 4.2.10 that stems from not limiting the number of uploads of dangero...

CVE-2023-3342

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'uruploadprofilepic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with...

CVE-2023-3342

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'uruploadprofilepic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with...

Hardcoded credentials

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'uruploadprofilepic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with...

CVE-2023-3342 User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'uruploadprofilepic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with...