EUVD-2023-57894

Malicious code in bioql PyPI...

CVE-2023-5601: Unrestricted Upload of File with Dangerous Type

The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE...

PT-2023-32205

Name of the Vulnerable Software and Affected Versions WooCommerce Ninja Forms Product Add-ons version 1.7.1 and earlier Description The issue concerns the WooCommerce Ninja Forms Product Add-ons WordPress plugin, which does not validate the file to be uploaded. This allows any unauthenticated use...

WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload

Description The plugin does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE. PoC Make sure to have both WooCommerce and NinjaForms 3.4.34.2 NF's latest version on the 3.4 branch installed, then follow those...