CVE-2019-16217

WordPress before 5.2.3 allows XSS in media uploads because wpajaxuploadattachment is mishandled...

File Upload Vulnerability in Harbin Xinzhongxin Electronic Co.

Harbin Xinzhongxin Electronics Co., Ltd. is a domestic campus card system solution provider, business covers intelligent campus, intelligent transportation, intelligent public security, intelligent park and other related fields. A file upload vulnerability exists in the one-card system of Harbin...

FreeBSD : wordpress -- multiple issues (8a9f86de-d080-11e9-9051-4c72b94353b5)

wordpress developersreports : Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments. Props to Tim Coen f...

wordpress -- multiple issues

wordpress developers reports: Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments. Props to Tim Coen f...

Craft CMS 2.7.9/3.2.5 - Information Disclosure

Exploit Title : CraftCms Users information disclosure From uploaded File Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 20-07-2019 Vendor Homepage:https://craftcms.com...

CVE-2018-21007

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

Design/Logic Flaw

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

CVE-2018-21007

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

CVE-2017-18592

The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wpupload directory for file uploads...

CVE-2017-18592

The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wpupload directory for file uploads...

CVE-2017-18592

The CVE-2017-18592 vulnerability affects the WordPress plugin woocommerce-catalog-enquiry (versions older than 3.1.0). The issue is an incorrect wp_upload directory used for file uploads, enabling an improper file placement path. Related sources describe this as an Arbitrary File Upload risk, wit...

WordPress wp-file-upload plugin code issue vulnerability

WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-file-upload is a file upload plugin used in it. A code issue vulnerability exists in the WordPress wp-file-upload plugin,...

WordPress wp-file-upload plugin code issue vulnerability (CNVD-2019-30990)

WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-file-upload is a file upload plugin used in it. A code issue vulnerability exists in the WordPress wp-file-upload plugin,...

Malicious Package

bb-builder is a malicious package. The package could run an executable targeting Windows and upload information to a remote server. Additionally an outside entity may gain full control of the computer via exploiting this malicious package...

CVE-2019-15127

REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-14794

The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...

CVE-2019-14794

The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...

Design/Logic Flaw

The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders...

CVE-2019-14794

CVE-2019-14794 affects the WordPress Meta Box plugin prior to version 4.16.2. The vulnerability arises from mishandling file uploads to custom folders, with a CVSS3 base score of 7.5 (network/vector, low access complexity, no privileges required, integrity impact HIGH). Public exploitation detail...