PT-2024-30592 · Sourcecodester · Sourcecodester Pisay Online E-Learning System

Name of the Vulnerable Software and Affected Versions: SourceCodester Pisay Online E-Learning System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Pisay Online E-Learning System, affecting an unknown functionality of the file /lesson/controller.php. The...

Pisay Online E-Learning System 代码问题漏洞

Sourcecodester Pisay Online E-Learning System is an online e-learning system based on PHP and MySQL. A code issue vulnerability exists in Pisay Online E-Learning System version 1.0, which stems from the parameter file in the file /lesson/controller.php that can lead to unrestricted uploads...

PT-2024-25013 · Unknown · Static Web Server

Name of the Vulnerable Software and Affected Versions: Static Web Server SWS affected versions not specified Description: The issue allows JavaScript code execution in the context of the web server's domain when directory listings are enabled for a directory that an untrusted user has upload...

Znuny和Znuny LTS 安全漏洞

Znuny is a work order system from Znuny, Inc. A security vulnerability exists in Znuny and Znuny LTS that stems from the presence of a path traversal vulnerability. An attacker could exploit the vulnerability to upload a file to an arbitrary writable location. Affected products and versions: Znun...

SUSE CVE-2024-3508

A flaw was found in Bombastic, which allows authenticated users to upload compressed bzip2 or zstd SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed...

CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-3962

The CVE CVE-2024-3962 affects Product Addons & Fields for WooCommerce (PPOM) on WordPress. It is caused by missing file type validation in the ppom_upload_file function, allowing unauthenticated arbitrary file uploads on all versions up to and including 32.0.18. Exploitation requires PPOM Pro ins...

EUVD-2024-32528

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-2920

The CVE-2024-2920 entry concerns the WP-Members Membership Plugin for WordPress, with Information Exposure affecting all versions up to 3.4.9.3. The root cause is that user-uploaded files are placed in a publicly accessible directory under wp-content, allowing unauthenticated attackers to view fi...

PT-2024-22802 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions up to, and including, 3.4.9.3 Description: The issue allows unauthenticated attackers to view files uploaded by other users, which may contain sensitive information, due to the plugin uploading...

PT-2024-24155 · Thinkcmf · Thinkcmf

Name of the Vulnerable Software and Affected Versions: ThinkCMF version 6.0.9 Description: The issue concerns a file upload vulnerability via the UeditorController.php. Recommendations: For ThinkCMF version 6.0.9, consider disabling the file upload functionality via UeditorController.php until a...

WordPress plugin Unlimited Elements For Elementor 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

Royal Elementor Addons and Templates < 1.3.95 - Unauthenticated Limited File Upload

Description The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'filevalidity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous...

PT-2024-3040 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator versions prior to 1.29.0 Description: The issue is related to an unrestricted upload of files with dangerous types in the Forminator plugin for WordPress. This could allow a remote attacker to upload arbitrary files to the server,...

FileBird < 5.6.4 - Author+ Users Folder Deletion

Description The plugin is vulnerable to Insecure Direct Object Reference via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads...

BMC Software Compuware iStrobe Web 安全漏洞

BMC Software Compuware iStrobe Web is a product from BMC Software designed for use on workstations in conjunction with the Strobe MVS Application Performance Measurement System. A security vulnerability exists in BMC Software Compuware iStrobe Web version 20.13 that stems from a remote shell uplo...

Vesystem Cloud Desktop 代码问题漏洞

Vesystem Cloud Desktop is a cloud desktop system from China's Hexin Chuangtian Vesystem. A code issue vulnerability exists in Vesystem Cloud Desktop 20240408 and prior versions, which stems from the parameter file in the file /Public/webuploader/0.1.5/server/fileupload.php that can lead to...

Vesystem Cloud Desktop 代码问题漏洞

Vesystem Cloud Desktop is a cloud desktop system from China's Hexin Chuangtian Vesystem. A code issue vulnerability exists in Vesystem Cloud Desktop 20240408 and prior versions, which stems from the parameter file in the file /Public/webuploader/0.1.5/server/fileupload2.php that can lead to...

PT-2024-3356 · Netcat · Netcat

Name of the Vulnerable Software and Affected Versions: Netcat affected versions not specified Description: The issue is related to a lack of restrictions on file uploads in the Netcat CMS system. This can be exploited by a remote attacker to execute arbitrary code or cause a denial of service...