CVE-2022-24651

CVE-2022-24651 affects SentCMS 4.0.x. The vulnerability allows remote attackers to upload arbitrary files via an unauthorized upload interface at /user/upload/upload, enabling PHP code execution. Multiple sources corroborate that the issue stems from lack of validation of uploaded files. No patch...

Nextcloud server 资源管理错误漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud server has a denial of service vulnerability that stems from a networked system or product that does not properly validate data boundaries when performing...

PT-2022-16844 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 21.0.8 Nextcloud Server versions prior to 22.2.4 Nextcloud Server versions prior to 23.0.1 Description: The issue affects Nextcloud server, an open source, self-hosted cloud style services platform. An...

WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.0. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...

Ninja Forms File Uploads Extension < 3.3.1 - Unauthenticated Arbitrary File Upload

The plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code...

WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.12 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Nuno Correia Blaze Security in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.12. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...

Ninja Forms File Uploads Extension < 3.3.13 - Unauthenticated Stored Cross-Site Scripting

The plugin is vulnerable to stored cross-site scripting due to missing sanitization of the files filename parameter found in the /includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites...

CVE-2021-24960

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks...

WordPress azw woocommerce file uploads plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress azw woocommerce file uploads plugin versions = 1.0.1. Solution No patched version available...

WordPress azw woocommerce file uploads plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress azw woocommerce file uploads plugin versions = 1.0.1. Solution No patched version available...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

WordPress Protect Uploads with Login – Protect Your Uploads plugin <= 1.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Protect Uploads with Login – Protect Your Uploads plugin versions = 1.8. Solution No patched version available...

WordPress Protect Uploads with Login – Protect Your Uploads plugin <= 1.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Protect Uploads with Login – Protect Your Uploads plugin versions = 1.8. Solution No patched version available...

Security fix for the ALT Linux 10 package python3-module-django version 3.2.12-alt1

3.2.12-alt1 built Feb. 25, 2022 Anton Farygin in task 295709 Feb. 20, 2022 Anton Farygin - 3.2.11 - 3.2.12 - Fixes for the following security vulnerabilities: + CVE-2022-22818: Possible XSS via % debug % template tag. + CVE-2022-23833: Denial-of-service possibility in file uploads...

Zfaka 代码问题漏洞

An input validation error vulnerability exists in Zfaka, a free, secure, stable and efficient card issuance system, which stems from the product's backend file upload function that does not validate files. An attacker could cause remote command execution through this vulnerability...

CVE-2022-24984

Forms generated by JQueryForm.com before 2022-02-05 if file-upload capability is enabled allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content...

Bbs Forum 代码问题漏洞

Bbs Forum Patrol Cloud Light Forum System is a forum system. A code issue vulnerability exists in BBS Forum, which originates from the product's getType function not performing security checks on uploaded files. An attacker can use this vulnerability to upload arbitrary files. The following...

CVE-2020-13675

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the si...

Projeqtor 安全漏洞

Projeqtor is a PHP-based open source project management software from the Projeqtor community. The software is used to organize various functions required for multiple projects and is suitable for IT projects. A cross-site scripting vulnerability exists in Projeqtor 9.3.1 that allows an attacker ...