CVE-2022-30808

elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manageuploads.php...

CVE-2022-30808

elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manageuploads.php...

Code injection

elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manageuploads.php...

Wedding Management System 代码问题漏洞

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. An attacker can exploit this vulnerability to upload malicious files and remotely execute arbitrary code...

elitecms 代码问题漏洞

Elitecms is a web content management from elitecms India. elitecms 1.01 has an arbitrary code execution vulnerability that can be exploited by attackers to execute arbitrary code attacks via admin/manageuploads.php...

PT-2022-14171 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs/gogs versions =0.12.7 Description: A remote command execution issue exists due to improper validation of the tree path parameter during file uploads. An attacker can upload a file into the .git directory by setting tree path=.git.,...

CVE-2022-1562

The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

WordPress plugin Enable SVG 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Enable SVG plugin version 1.4.0 or earlier has a cross-site scripting vulnerability that...

PT-2022-14196 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: gitea versions prior to 1.16.9 Description: The issue is related to Stored Cross-site Scripting XSS in the GitHub repository go-gitea/gitea. This occurs via unfiltered pdfs. Recommendations: For versions prior to 1.16.9, update to version...

qdPM 9.1 - Remote Code Execution (Authenticated) Exploit

Exploit Title: qdPM 9.1 - Remote Code Execution RCE Authenticated Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Original Exploit Author: Rishal Dwivedi Loginsoft Original ExploitDB ID: 47954 https://www.exploit-db.com/exploits/47954 Exploit Author: Leon Trappett thepcn3rd Vendor...

CVE-2022-30999 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

FriendsofFlarum FoF Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files 'image/svg+xml', navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an...

GHSA-GV2W-88HX-8M9R Improper Authorization in Undertoe

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a...

GHSA-CRG2-6XV3-QG5F Improper Neutralization of Input During Web Page Generation in Jenkins

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier served files uploaded as file parameters to a build without specifying appropriate Content-Security-Policy HTTP headers. This resulted in a stored cross-site scripting XSS vulnerability exploitable by users with permissions to build a job with fi...

GHSA-J8WR-7XXJ-C2FR Moodle Private files uploaded via incoming mail processing could bypass quota restrictions

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded...

CVE-2022-22970

A flaw was found in Spring Framework. Applications that handle file uploads are vulnerable to a denial of service DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object...

IBM Sterling B2B Integrator 代码问题漏洞

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with different partner communities.A denial of service vulnerability exists in IBM Sterling B2B...

Code injection

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code...

PT-2022-3660 · Unknown +1 · Formidable +1

Name of the Vulnerable Software and Affected Versions: formidable version 3.1.4 formidable version 3.2.4 Description: An arbitrary file upload vulnerability in formidable allows attackers to execute arbitrary code via a crafted filename. Some third parties dispute this issue because the product h...

WordPress plugin AGIL 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress AGIL plugin 1.0 and earlier versions have a file upload vulnerability, which stems from accepting a...

Total Avengers Totaljs Framework 跨站脚本漏洞

Total Avengers Totaljs Framework is a Javascript-based code base for building web, desktop, service or IoT applications from Total Avengers, Slovakia. The application is similar to PHPs Laravel, Pythons Django, ASP.NET MVC for building Node applications.A cross-site scripting vulnerability exists...