Total
3968 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-1721 | 1 Yoga Class Registration System Project | 1 Yoga Class Registration System | 2024-11-27 | 9.1 Critical |
| Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators. | ||||
| CVE-2023-36630 | 1 Mgt-commerce | 1 Cloudpanel | 2024-11-27 | 8.8 High |
| In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass. | ||||
| CVE-2020-20210 | 1 Bludit | 1 Bludit | 2024-11-27 | 8.8 High |
| Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. | ||||
| CVE-2023-34833 | 1 Thinkadmin | 1 Thinkadmin | 2024-11-27 | 6.1 Medium |
| An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file. | ||||
| CVE-2023-34738 | 1 Chemex | 1 Chemex | 2024-11-27 | 9.8 Critical |
| Chemex through 3.7.1 is vulnerable to arbitrary file upload. | ||||
| CVE-2022-40896 | 2 Pygments, Redhat | 4 Pygments, Ansible Automation Platform, Satellite and 1 more | 2024-11-27 | 5.5 Medium |
| A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. | ||||
| CVE-2024-9942 | 2 Dasinfomedia, Mojoomla | 2 Wpgym Gym Management System, Wordpress Gym Management System | 2024-11-26 | 9.8 Critical |
| The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload() function in all versions up to, and including, 67.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2020-18432 | 1 Sem-cms | 1 Semcms | 2024-11-26 | 9.8 Critical |
| File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges. | ||||
| CVE-2023-48965 | 1 Thinkadmin | 1 Thinkadmin | 2024-11-26 | 8.8 High |
| An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file. | ||||
| CVE-2023-48930 | 1 Rockoa | 1 Xinhu | 2024-11-26 | 9.8 Critical |
| xinhu xinhuoa 2.2.1 contains a File upload vulnerability. | ||||
| CVE-2022-20743 | 1 Cisco | 1 Secure Firewall Management Center | 2024-11-26 | 6.5 Medium |
| A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to the web management interface of Cisco FMC Software. An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges. | ||||
| CVE-2023-50038 | 1 Textpattern | 1 Textpattern | 2024-11-26 | 8.8 High |
| There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. | ||||
| CVE-2018-15424 | 1 Cisco | 1 Identity Services Engine | 2024-11-26 | 4.7 Medium |
| A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server. | ||||
| CVE-2020-22151 | 1 Thedaylightstudio | 1 Fuel Cms | 2024-11-25 | 9.8 Critical |
| Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function. | ||||
| CVE-2021-24171 | 1 Vanquish | 1 Woocommerce Upload Files | 2024-11-25 | 9.8 Critical |
| The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter. | ||||
| CVE-2023-1415 | 1 Code-projects | 1 Simple Art Gallery | 2024-11-22 | 6.3 Medium |
| A vulnerability was found in Simple Art Gallery 1.0. It has been declared as critical. This vulnerability affects the function sliderPicSubmit of the file adminHome.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-223126 is the identifier assigned to this vulnerability. | ||||
| CVE-2023-1800 | 1 Go-fastdfs Project | 1 Go-fastdfs | 2024-11-22 | 7.3 High |
| A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768. | ||||
| CVE-2023-1442 | 1 Qykcms | 1 Qykcms | 2024-11-22 | 4.7 Medium |
| A vulnerability was found in Meizhou Qingyunke QYKCMS 4.3.0. It has been classified as problematic. This affects an unknown part of the file /admin_system/api.php of the component Update Handler. The manipulation of the argument downurl leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223287. | ||||
| CVE-2023-2246 | 1 Online Pizza Ordering System Project | 1 Online Pizza Ordering System | 2024-11-22 | 6.3 Medium |
| A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236. | ||||
| CVE-2020-22153 | 1 Thedaylightstudio | 1 Fuel Cms | 2024-11-22 | 9.8 Critical |
| File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function. | ||||