CVE-2021-20707

Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to rea...

VulnCheck KEV: CVE-2021-22205

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files...

CVE-2021-39333 Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content Deletion

The Hashthemes Demo Importer Plugin = 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of...

CVE-2018-25019

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

Design/Logic Flaw

The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spluploadserimg AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload images...

WordPress 访问控制错误漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The WordPress Stylish Price List plugin is vulnerable to an access control error in versions prior to 6.9.0, which stems from the plugin's lack of user identity checking in its spluploadserimg AJAX...

FlatCore-CMS 代码问题漏洞

FlatCore-CMS is a Web Content Management System CMS based on PHP and MySQL/SQLite. A code issue vulnerability exists in flatcore-cms that stems from unlimited uploaded files with dangerous types...

Sourcecodester Customer Relationship Management System 代码问题漏洞

Sourcecodester Customer Relationship Management System is an open source Php project by the individual developer Carlo Montero. Used to provide an online platform for companies to manage interactions with their customers or prospects. A file upload vulnerability exists in Sourcecodester Customer...

CSZ CMS SQL注入漏洞

CSZ CMS is a PHP-based open source content management system CMS. A file upload vulnerability exists in the v1.2.4 version of CSZ CMS, which originates from the /core/MYSecurity.php component of the product not validating the uploaded file. An attacker can use this vulnerability to upload arbitra...

BookStack 代码问题漏洞

BookStack is an open source platform for building wiki documents using PHP and Laravel from the BookStackApp Bookstackapp team. A code issue vulnerability exists in bookstack that stems from bookstack's susceptibility to unlimited uploads of dangerous types of files...

CVE-2021-40344

An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution...

CVE-2021-40344

An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution...

Rocket.Chat: Content-Security Policy bypass with File Uploads

The default Content-Security Policy CSP in Rocket.Chat versions 4.0.3 and 3.18.2 was bypassed by uploading a JavaScript file through the file upload feature. This file could then be included in the web application, allowing the execution of arbitrary scripts...

PYSEC-2021-381

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model tar.gz file which allows a malicious actor to craft a model.tar.gz file which can overwrite or replace bot...

CVE-2021-39352

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the /inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with...

Design/Logic Flaw

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the /inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with...

Wordpress Plugin Catch Themes Demo Import RCE

The Wordpress Plugin Catch Themes Demo Import versions use exploit/multi/http/wp/catchthemesdemoimport msf undefinedcatchthemesdemoimport show actions ...actions... msf undefinedcatchthemesdemoimport set ACTION msf undefinedcatchthemesdemoimport show options ...show and set options... msf...

Rasa 安全漏洞

Rasa is an open source machine learning framework for automating text- and speech-based conversations. Rasa suffers from a security vulnerability that stems from the upload of untrusted model files in the affected version. An attacker could use the vulnerability to overwrite or replace bot files ...

Cross-site Scripting (XSS) - Stored in forkcms/forkcms

Description When uploading a new theme, the description of a theme can contain JavaScript code. This can be used for Cross-Site-Scripting. Proof of Concept I downloaded the Kompact theme https://github.com/jessedobbelaere/fork-cms-theme-kompact/archive/master.zip, extracted it and changed in...

Server-Side Request Forgery (SSRF)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF which allows attackers to read files stored in the internal server. This is because...