Privilege escalation

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage function...

CVE-2020-28165

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage function...

CVE-2020-28165

CVE-2020-28165 affects EasyCorp ZenTao PMS 12.4.2 with an arbitrary file upload vulnerability exposed through the downloadZipPackage() function, allowing upload of arbitrary webshells to the server. Connected sources corroborate the vulnerability description; no additional exploit details, affect...

CVE-2020-21976

An arbitrary file upload in the component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands...

CVE-2020-21976

An arbitrary file upload in the component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands...

Design/Logic Flaw

An arbitrary file upload in the component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands...

CVE-2020-21976

An arbitrary file upload in the component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands...

CVE-2020-21976

CVE-2020-21976 affects NewsOne CMS v1.1.0 via an arbitrary file upload in the field. Root cause is an unrestricted file upload, enabling attackers to webshell and execute arbitrary commands. CVSSv3.1 base score 8.8 (HIGH) with NETWORK attack vector and LOW access complexity; high impact to confi...

NewsOne CMS 代码问题漏洞

NewsOne CMS is a web-based news, magazine script. It is possible to develop your own media/news website. A security vulnerability exists in NewsOne CMS version 1.1.0, which originates from an arbitrary file upload vulnerability in the component of the software, which allows an attacker to use a...

Exploit for SQL Injection in Agentejo Cockpit

Cockpit CMS NoSQL Injection to Remote Code Execution : CVE-202...

CVE-2020-19302

An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to ".php"...

CVE-2020-19302

An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to ".php"...

Design/Logic Flaw

An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to ".php"...

CVE-2020-19302

An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to ".php"...

CVE-2020-19302

The CVE-2020-19302 issue affects vaeThink v1.0.1, where the avatar upload function accepts arbitrary file uploads. The root cause is that uploaded files can be misrepresented by changing the suffix to #".php"#, enabling an attacker to execute a webshell. Impact is high per the cited sources, with...

vaeThink 代码问题漏洞

vaeThink is a software application. Based on ThinkPHP5 and Layui development, in keeping the core concept of rapid development and the road to simplicity remains unchanged at the same time, the general project of the necessary functionality of the basic development and packaging, to help users in...

ObjectPlanet Opinio 7.13 Shell Upload

Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng CVE: CVE-2020-26806 Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload Vendor Homepage: https://www.objectplanet.com/opinio/ Software Link: https://www.objectplanet.com/opinio/ Exploit Authors: Timoth...

ObjectPlanet Opinio 7.13 Shell Upload Vulnerability

Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng CVE: CVE-2020-26806 Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload Vendor Homepage: https://www.objectplanet.com/opinio/ Software Link: https://www.objectplanet.com/opinio/ Exploit Authors: Timoth...

Hutchinson Next-Generation Cloud Desktop Has File Upload Vulnerability

Hutchison Next Generation Desktop is a desktop virtualization product based on NGD Next Generation Desktop architecture. Hutchinson Next Generation Desktop has a file upload vulnerability, which can be exploited by attackers to upload a webshell and gain server privileges...

File upload vulnerability in concrete friend mixing plant ERP management system

Hunan AOKE Network Technology Co., Ltd. is a concrete enterprise informatization solution provider. The concrete friend mixing station ERP management system has an arbitrary file upload vulnerability, which can be exploited by an attacker to upload a webshell and gain server privileges...