CVE-2019-16640

An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled %00 and /var/./html are not checked, which can allow an attacker to upload any file to the gateway. This affects EG-2000SE EGRGOS 11.9 B11P1...

The vulnerability of the Upload Data module in the Splunk Web interface of the Splunk Enterprise operational analytics platform allows a hacker to write arbitrary files.

The vulnerability of the Upload Data module in the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the unlimited uploading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to upload any type of file...

Nanjing Xingyuantu Technology SparkShop Code Issue Vulnerability

Nanjing Xingyuantu Technology SparkShop is an open source shopping mall from Nanjing Xingyuantu Technology, a Chinese company. A code issue vulnerability exists in Nanjing Xingyuantu Technology SparkShop 1.1.6 and earlier versions, which stems from the parameter file in the file...

CVE-2024-5450

The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files...

WordPress plugin wp-eMember security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in...

[SECURITY] Fedora 39 Update: python-urllib3-1.26.19-1.fc39

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: =E2=80=A2 Thread safety. =E2=80=A2 Connection pooling. =E2=80=A2 Client-side SSL/TLS verification. =E2=80=A2 File uploads with multipart encoding...

PT-2024-28180 · Realtyna · Realtyna Organic Idx Plugin

Name of the Vulnerable Software and Affected Versions: Realtyna Organic IDX plugin versions n/a through 4.14.13 Description: The issue affects the Realtyna Organic IDX plugin, allowing for the unrestricted upload of files with dangerous types, which can lead to code injection. Recommendations: Fo...

WordPress plugin Realtyna Organic IDX plugin Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Import Spreadsheets from Microsoft Excel Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2023-7061

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make...

CVE-2023-7061

CVE-2023-7061 affects the Advanced File Manager Shortcodes plugin for WordPress. The vulnerability allows authenticated attackers with contributor-level access or higher to upload arbitrary files, which may lead to remote code execution on the affected site. Wordfence reports the issue as patched...

Croogo Code Issues Vulnerabilities

Croogo is a content management system CMS developed on the CakePHP framework. The system provides content type can be customized as Blog, Node, Page, content editing using WYSIWYG editor and other features. Croogo 4.0.7 and earlier versions of the code problem vulnerability , the vulnerability...

CVE-2024-6314

The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'processimageupload' function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-6313

The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-6161

The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'getcacheimage' function in all versions up to, and including, 1.0.2.3. This makes it possible for authenticated attackers, with contributor-level and above...

CVE-2024-6313

The CVE 2024-6313 entry concerns Gutenberg Forms – WordPress Form Builder Plugin. The Red Hat advisory and Wordfence vulnerability data indicate an unauthenticated arbitrary file upload in the plugin’s upload handling (versions up to and including 2.2.9), arising from insufficient validation of a...

CVE-2024-6123

CVE-2024-6123 (Bit Form, WordPress): The Bit Form plugin (WordPress) versions up to and including 2.13.3 are vulnerable to arbitrary file uploads due to missing file type validation in the iconUpload function. This allows an attacker with administrator-level or higher privileges to upload arbitra...

CVE-2024-6161

CVE-2024-6161 affects the Default Thumbnail Plus WordPress plugin. The vulnerability stems from missing file type validation in the get_cache_image function, affecting all versions up to 1.0.2.3. This allows authenticated attackers with contributor-level (or higher) permissions to upload arbitrar...

EUVD-2024-47302

The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'getcacheimage' function in all versions up to, and including, 1.0.2.3. This makes it possible for authenticated attackers, with contributor-level and above...

CVE-2024-5441

The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setfeaturedimage function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to uploa...