Total
3185 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-20735 | 1 8cms | 1 Ljcms | 2024-12-10 | 9.8 Critical |
| File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter. | ||||
| CVE-2020-20718 | 1 Pluck-cms | 1 Pluckcms | 2024-12-10 | 9.8 Critical |
| File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file() parameter. | ||||
| CVE-2020-21174 | 1 Feehi | 1 Feehicms | 2024-12-10 | 9.8 Critical |
| File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function. | ||||
| CVE-2020-21474 | 1 Nucleuscms | 1 Nucleuscms | 2024-12-10 | 9.8 Critical |
| File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter. | ||||
| CVE-2024-42375 | 1 Sap | 1 Business Objects Business Intelligence Platform | 2024-12-10 | 4.3 Medium |
| SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. | ||||
| CVE-2024-41731 | 1 Sap | 1 Business Objects Business Intelligence Platform | 2024-12-10 | 3.1 Low |
| SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. | ||||
| CVE-2024-28166 | 1 Sap | 1 Business Objects Business Intelligence Platform | 2024-12-10 | 3.7 Low |
| SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. | ||||
| CVE-2024-4927 | 1 Oretnom23 | 1 Simple Online Bidding System | 2024-12-09 | 7.3 High |
| A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=save_product. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264463. | ||||
| CVE-2020-21489 | 1 Feehi | 1 Feehicms | 2024-12-09 | 9.8 Critical |
| File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component. | ||||
| CVE-2020-21325 | 1 Wuzhicms | 1 Wuzhicms | 2024-12-09 | 8.8 High |
| An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file. | ||||
| CVE-2024-53822 | 1 Genetechsolutions | 1 Pie Register | 2024-12-09 | 10 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. | ||||
| CVE-2024-1819 | 1 Codeastro | 1 Membership Management System | 2024-12-07 | 4.7 Medium |
| A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the component Add Members Tab. The manipulation of the argument Member Photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254607. | ||||
| CVE-2024-1818 | 1 Codeastro | 1 Membership Management System | 2024-12-07 | 4.7 Medium |
| A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /uploads/ of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254606 is the identifier assigned to this vulnerability. | ||||
| CVE-2022-3257 | 1 Mattermost | 1 Mattermost Server | 2024-12-06 | 3.1 Low |
| Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service. | ||||
| CVE-2023-27083 | 1 Pluck-cms | 1 Pluck | 2024-12-06 | 7.2 High |
| An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality. | ||||
| CVE-2024-10578 | 1 Blazethemes | 1 Pubnews | 2024-12-06 | 8.8 High |
| The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_action_for_notice() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins that can be leveraged to exploit other vulnerabilities. | ||||
| CVE-2024-53811 | 2024-12-06 | 6.6 Medium | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in POSIMYTH WDesignkit allows Upload a Web Shell to a Web Server.This issue affects WDesignkit: from n/a through 1.0.40. | ||||
| CVE-2024-53982 | 1 Zoo Project | 1 Zoo | 2024-12-05 | N/A |
| ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this parameter, which allows an attacker to fully control the file which is returned in the response. Patch was committed in November 22nd, 2024. | ||||
| CVE-2022-44276 | 1 Tecrail | 1 Responsive Filemanager | 2024-12-05 | 9.8 Critical |
| In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE. | ||||
| CVE-2023-34736 | 1 Guantang Equipment Management System Project | 1 Guantang Equipment Management System | 2024-12-05 | 7.2 High |
| Guantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload. | ||||