CVE-2023-32628

In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution...

CVE-2023-33386

MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background...

PT-2023-24327 · Marsctf · Marsctf

Name of the Vulnerable Software and Affected Versions: MarsCTF version 1.2.1 Description: The issue is related to an arbitrary file upload vulnerability in the interface for uploading attachments in the background. This allows for potential malicious file uploads. Recommendations: For MarsCTF...

Agro-School Management System 代码问题漏洞

Agro-School Management System is the Agro-School Management System. code-projects A code issue vulnerability exists in Agro-School Management System version 1.0 due to unknown handling of the file btnfunctions.php in the component Attachment Image Handler, which results in unrestricted uploads...

PT-2023-22807 · Code Projects · Agro-School Management System

Name of the Vulnerable Software and Affected Versions: code-projects Agro-School Management System version 1.0 Description: A critical issue affects the Attachment Image Handler component, specifically the file btn functions.php, leading to unrestricted upload. The attack can be initiated remotel...

PT-2023-3766 · Mitsubishi · Melsec Iq-F Series Ethernet/Ip Module Fx5-Enet/Ip +1

Name of the Vulnerable Software and Affected Versions: MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 affected versions not specified MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP affected versions not specified Description: The issue is related to an unrestricted upload of files with...

StarsAlliance PsychoStats 跨站脚本漏洞

PsychoStats is a StarsAlliance open source application. A cross-site scripting vulnerability exists in StarsAlliance PsychoStats 3.2.2a and earlier versions, which stems from a problem with file uploads/admin/login.php and can be exploited by an attacker to conduct cross-site scripting XSS attack...

Kramer VIA GO² 代码问题漏洞

The Kramer VIA GO² is a 4K wireless presentation device from Kramer. A security vulnerability exists in KramerAV VIA GO² versions prior to 4.0.1.1326 that stems from vulnerability to unauthenticated file uploads, which can lead to remote code execution RCE...

The vulnerability of the App/Ajax/ajax.php?action=mobileUploadSave component of the software platform for small and medium-sized business collaboration software Weaver E-Office allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the component App/Ajax/ajax.php?action=mobileUploadSave on the software platform for small and medium-sized business collaboration software Weaver E-Office is related to the lack of restrictions on file uploads. Exploiting this vulnerability could allow a malicious actor to...

CVE-2023-32689 Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server vi...

CVE-2023-28700

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

Faronics Insight 代码问题漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which stems from the ability of an unauthenticated attacker to upload any type of file to any location on the teacher's end of the computer, whi...

Code injection

A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/articleallowurledit.php. The manipulation of the argument allurls leads to code injection. The attack can be launched remotely...

CVE-2023-2928

CVE-2023-2928 affects DedeCMS up to version 5.7.106. The vulnerability lies in the uploads/dede/article_allowurl_edit.php functionality where manipulating the allurls parameter leads to code injection. Impact is remote, and public exploits have been disclosed. Mitigation from connected documents ...

CVE-2023-2928 DedeCMS article_allowurl_edit.php code injection

A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/articleallowurledit.php. The manipulation of the argument allurls leads to code injection. The attack can be launched remotely...

Supcon SimField 代码问题漏洞

Supcon SimField is an intelligent mobile device monitoring platform from Supcon China. A code issue vulnerability exists in versions of Supcon SimField prior to 1.80.00.00, which stems from a problem with the file /admin/reportupload.aspx, where manipulation of the parameter files can result in...

PT-2023-22229 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions up to 5.7.106 Description: A critical issue affects an unknown functionality of the file uploads/dede/article allowurl edit.php. The manipulation of the allurls argument leads to code injection. The attack can be launched...

CVE-2023-22504

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature...

TIBCO Security Advisory: May 25, 2023 - TIBCO EBX Add-ons -CVE-2023-26216

TIBCO EBX Add-ons Path Traversal Original release date: May 25, 2023 Last revised: --- CVE-2023-26216 Source: TIBCO SoftwareInc. Products Affected TIBCO EBX Add-ons versions 4.5.16 and below The following component is affected: server Description The component listed above contains an exploitable...

CVE-2023-2496

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validateupload' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a...