PT-2022-22267 · WordPress · Dmitrylitvinov Uploading Svg

Name of the Vulnerable Software and Affected Versions: dmitrylitvinov Uploading SVG, WEBP and ICO files plugin version 1.0.1 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by an authenticated use...

PT-2022-22434 · Zengenti · Zengenti Contensis Classic

Name of the Vulnerable Software and Affected Versions: Zengenti Contensis Classic versions prior to 15.2.1.79 Description: The file upload wizard does not correctly check that a user has authenticated, allowing the execution of arbitrary commands by uploading a crafted aspx file. Recommendations:...

CVE-2022-2594

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration so PHP is not possible if there is a frontend form available. This vulnerability was introduced i...

CVE-2022-2594

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration so PHP is not possible if there is a frontend form available. This vulnerability was introduced i...

Design/Logic Flaw

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration so PHP is not possible if there is a frontend form available. This vulnerability was introduced i...

Emerson Proficy Machine Edition

1. EXECUTIVE SUMMARY CVSS v3 6.6 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Emerson Equipment: Proficy Machine Edition Vulnerabilities: Missing Support for Integrity Check, Improper Access Control, Unrestricted Upload of File with Dangerous Type, Improper Verification of...

CVE-2022-2180

The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution RCE...

WordPress theme GREYD.SUITE 代码问题漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL.WordPress theme is a theme for WordPress. WordPress theme GREYD.SUITE suffers from a code issue vulnerability that stems from not properly...

Zoo Management System 代码问题漏洞

Zoo Management System is a zoo management system by Carlo Montero, an individual developer. It provides an online and automated platform for zoo organizations to manage their daily records. A code issue vulnerability exists in Zoo Management System. An attacker could exploit the vulnerability by...

Gas Agency Management System 代码问题漏洞

Gas Agency Management System is a gas agency management software by Mayuri K. Personal Developer. It is used to manage the day-to-day operations of a gas agency. A code issue vulnerability exists in Gas Agency Management System. An attacker can exploit this vulnerability to manipulate shell...

Gym Management System 代码问题漏洞

Gym Management System is a gym management system. The system is developed in C and sql server and features customer and vendor management, product management, sales management, gym membership management, fitness assessment, system logging, database backup and restore. A code issue vulnerability...

Company Website CMS 代码问题漏洞

Company Website CMS is a company website/CMS by Torrahclef Personal Developer. Company Website CMS suffers from a code issue vulnerability that stems from some unknown functionality of /dashboard/add-portfolio.php being affected, where manipulation of the parameter ufile can lead to unrestricted...

Company Website CMS 代码问题漏洞

Company Website CMS is a company website/CMS by Torrahclef Personal Developer. A security vulnerability exists in Company Website CMS, which stems from an unknown function of the file /dashboard/add-service.php of the component Add Service Handler being affected, resulting in unrestricted uploads...

PT-2022-4095 · Adobe · Adobe Experience Manager Core Components

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager Core Components versions 2.20.6 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability, which may allow an attacker to execute malicious JavaScript content within the conte...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

CVE-2022-2356

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded...

CVE-2022-2356

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded...

WordPress Plugin Frontend File Manager & Sharing 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

Alphaware Simple E-Commerce System 代码问题漏洞

Alphaware Simple E-Commerce System is an e-commerce system by razormist individual developers. The Alphaware Simple E-Commerce System suffers from a code issue that arises from an unknown portion of the adminfeature.php code in its backend administration interface that allows an attacker to perfo...

PT-2022-4007 · Digi · Digi Connectport X2E

Name of the Vulnerable Software and Affected Versions: Digi ConnectPort X2D affected versions not specified Description: The issue is related to errors in access control, allowing a remote attacker to execute arbitrary code by uploading specially crafted python files. This is due to the lack of...