The vulnerability of the Php Inventory & Invoice Management System web application lies in the lack of restrictions on file downloads, allowing a malicious user to upload a malicious file.

The vulnerability of the Php Inventory & Invoice Management System web application is related to the lack of restrictions on file uploads. Exploiting this vulnerability allows a malicious actor to upload a malicious file to the file system, where it can be executed “/dashboard/editmyaccountdetail...

Free CMS 1.0a Cross Site Scripting

============================================================================================================================ | Title : Free cms 1.0a xss via file uploads Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 FranASSais V.Pro | | | Vendor :...

Rich FileManager 2.7.0 Cross Site Scripting

============================================================================================================================ | Title : Rich FileManager v2.7.0 xss via file uploads Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 FranASSais V.Pro | | | Vend...

CVE-2016-6598

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service FileStorageService on port 9010. This service contains a method that allows uploading a file to an arbitrary path on the machine that is running Track-It!. This can be used to upload a file to the web...

WonderCMS Malicious File Upload Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. A malicious file upload vulnerability exists in WonderCMS 2.3.1. The vulnerability arises because the upload function accepts random application extensions. An attacker can exploit this vulnerability to upload malicious files...

Multiple Vulnerabilities in Beipiao's Microclass App

Beipiao Microcourse APP is an educational course learning service software. There are loopholes in Beipiao Microcourse APP for arbitrary user registration, arbitrary user password reset and arbitrary file upload. An attacker can use the vulnerability to register any account, reset any password an...

Western Digital MyCloud Remote Code Execution (CVE-2017-17560)

A remote code execution vulnerability exists within Western Digital MyCloud servers. This is due to the way the MyCloud servers handle file uploads to specific directories. A successful attack could lead to a remote code execution and stolen information...

CVE-2014-4972: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravityforms...

WordPress AccessKeys AccessPress Anonymous Post Pro Plugin Arbitrary File Upload Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.AccessKeys AccessPress Anonymous Post Pro plugin is used in one of the anonymous publishing plugin. An arbitrary...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17874: Unrestricted Upload of File with Dangerous Type

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

PT-2017-15063

Name of the Vulnerable Software and Affected Versions Vanguard Marketplace Digital Products PHP version 1.4 Description The issue allows for arbitrary file upload through actions such as "Add a new product" or "Add a product preview". This can result in a .php file being made accessible under a...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-16949

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

CVE-2017-17593

Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...

CVE-2017-17593

Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...

CVE-2017-17593

CVE-2017-17593 affects Simple Chatting System 1.0 (PHP-based). The vulnerability is an arbitrary file upload via the endpoint view/my_profile.php, which allows uploaded files to be placed under uploads/. Root cause: insufficient input validation on file uploads (as described across CNVD/NVD recor...

CVE-2017-17593: Unrestricted Upload of File with Dangerous Type

Simple Chatting System 1.0 allows Arbitrary File Upload via view/myprofile.php, which places files under uploads/...