8588 matches found
WonderCMS Malicious File Upload Vulnerability
WonderCMS is an open source, fast, small and simple flat file cms. A malicious file upload vulnerability exists in WonderCMS 2.3.1. The vulnerability arises because the upload function accepts random application extensions. An attacker can exploit this vulnerability to upload malicious files...
Multiple Vulnerabilities in Beipiao's Microclass App
Beipiao Microcourse APP is an educational course learning service software. There are loopholes in Beipiao Microcourse APP for arbitrary user registration, arbitrary user password reset and arbitrary file upload. An attacker can use the vulnerability to register any account, reset any password an...
Western Digital MyCloud Remote Code Execution (CVE-2017-17560)
A remote code execution vulnerability exists within Western Digital MyCloud servers. This is due to the way the MyCloud servers handle file uploads to specific directories. A successful attack could lead to a remote code execution and stolen information...
WordPress AccessKeys AccessPress Anonymous Post Pro Plugin Arbitrary File Upload Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.AccessKeys AccessPress Anonymous Post Pro plugin is used in one of the anonymous publishing plugin. An arbitrary...
CVE-2017-17874
Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...
CVE-2017-17874
Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...
CVE-2017-17874
Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...
CVE-2017-17874
Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...
CVE-2017-16949
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...
CVE-2017-17593
Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...
CVE-2017-17593
CVE-2017-17593 affects Simple Chatting System 1.0 (PHP-based). The vulnerability is an arbitrary file upload via the endpoint view/my_profile.php, which allows uploaded files to be placed under uploads/. Root cause: insufficient input validation on file uploads (as described across CNVD/NVD recor...
CVE-2017-17593
Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...
WordPress Cross-Site Scripting Vulnerability (CNVD-2017-38267)
WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A cross-site scripting vulnerability exists in WordPress before 4.9.1. The vulnerability...
CVE-2017-1000147
Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery CSRF attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into...
MGASA-2017-0400 Updated tomcat packages fix security vulnerability
When running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server...
Design/Logic Flaw
edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter...
CVE-2017-15285
X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...
IRCCloud: Missing robots exclusion header for user uploads
User uploaded text files can be linked from external websites and end up appearing in search engine result pages if you perform a search such as: site:.irccloud-cdn.com ext:txt It's not possible to completely prevent such listings on all search engines, but some search crawlers support the...