CVE-2019-7436: Exposure of Sensitive Information to an Unauthorized Actor

PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory...

CVE-2019-7434: Exposure of Sensitive Information to an Unauthorized Actor

PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory...

CVE-2018-20628: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

CVE-2018-20646: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory...

CVE-2019-8933

In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...

PT-2019-19268

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7SP2 Description The issue allows attackers to upload a .php file to the uploads/ directory and then execute it. This can be achieved by visiting the management page, clicking on the template, clicking on Default Template...

Cross site scripting

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

Directory override delete vulnerability in Monstra CMS backend filesmanager.admin.php file

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory override vulnerability exists in the filesmanager.admin.php file in the backend of Monstra CMS. A...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17593

Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...

CVE-2017-17593

Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...

KBVault MySQL Arbitrary File Upload Vulnerability

KBVault is a free knowledge base web application. An arbitrary file upload vulnerability exists in KBVault MySQL. An unauthenticated user can use the following URI: http://host/FileExplorer/Explorer.aspx?id=/Uploads访问文件上传 and delete function...

PT-2017-6703 · Qdpm · Qdpm

Name of the Vulnerable Software and Affected Versions: qdPM version 8.3 Description: The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to various pages in qdPM, including myAccount, projects, tasks, tickets, discussions, reports, and...

Fedora 23 : wordpress (2016-a5e392ef01)

See upstream announcement WordPress 4.5.3 Maintenance and Security Release Packaging changes : - provide nginx configuration fedora - drop mandatory dependency on httpd suggested 1336091 - protect php files in uploads directory Note that Tenable Network Security has extracted the preceding...

Fedora 22 : wordpress (2016-4573f8c9ba)

See upstream announcement WordPress 4.5.3 Maintenance and Security Release Packaging changes : - provide nginx configuration fedora - drop mandatory dependency on httpd suggested 1336091 - protect php files in uploads directory Note that Tenable Network Security has extracted the preceding...

CVE-2014-9521

Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the...

PHP Volunteer Management System 1.0.2 - Arbitrary File Upload

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...