Total
2868 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-52476 | 1 Stefanbohacek | 1 Fediverse Embeds | 2024-12-02 | 10 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in stefanbohacek Fediverse Embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through 1.5.3. | ||||
| CVE-2023-39548 | 1 Nec | 2 Expresscluster X, Expresscluster X Singleserversafe | 2024-12-02 | 8.8 High |
| CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command. | ||||
| CVE-2023-36097 | 1 Funadmin | 1 Funadmin | 2024-12-02 | 9.8 Critical |
| funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install. | ||||
| CVE-2023-39539 | 1 Ami | 1 Aptio V | 2024-12-02 | 7.5 High |
| AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability. | ||||
| CVE-2024-52769 | 1 Dedebiz | 1 Dedebiz | 2024-11-29 | 7.2 High |
| An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a crafted file. | ||||
| CVE-2024-11082 | 1 Tumult | 1 Tumult Hype Animations | 2024-11-29 | 9.9 Critical |
| The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-52490 | 1 Pathomation | 1 Pathomation | 2024-11-29 | 10 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in Pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through 2.5.1. | ||||
| CVE-2018-0258 | 1 Cisco | 2 Prime Data Center Network Manager, Prime Infrastructure | 2024-11-29 | N/A |
| A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727. | ||||
| CVE-2024-51364 | 1 Gelcon | 1 Modbusmechanic | 2024-11-27 | 8.8 High |
| An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. | ||||
| CVE-2023-1721 | 1 Yoga Class Registration System Project | 1 Yoga Class Registration System | 2024-11-27 | 9.1 Critical |
| Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators. | ||||
| CVE-2023-36630 | 1 Mgt-commerce | 1 Cloudpanel | 2024-11-27 | 8.8 High |
| In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass. | ||||
| CVE-2020-20210 | 1 Bludit | 1 Bludit | 2024-11-27 | 8.8 High |
| Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. | ||||
| CVE-2023-34833 | 1 Thinkadmin | 1 Thinkadmin | 2024-11-27 | 6.1 Medium |
| An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file. | ||||
| CVE-2023-34738 | 1 Chemex | 1 Chemex | 2024-11-27 | 9.8 Critical |
| Chemex through 3.7.1 is vulnerable to arbitrary file upload. | ||||
| CVE-2022-40896 | 2 Pygments, Redhat | 4 Pygments, Ansible Automation Platform, Satellite and 1 more | 2024-11-27 | 5.5 Medium |
| A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. | ||||
| CVE-2024-51208 | 1 Phpgurukul | 1 Boat Booking System | 2024-11-26 | 7.2 High |
| File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter. | ||||
| CVE-2024-53619 | 1 Spip | 1 Spip | 2024-11-26 | 6.3 Medium |
| An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file. | ||||
| CVE-2024-9942 | 2 Dasinfomedia, Mojoomla | 2 Wpgym Gym Management System, Wordpress Gym Management System | 2024-11-26 | 9.8 Critical |
| The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload() function in all versions up to, and including, 67.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-52677 | 1 Hkcms | 1 Hkcms | 2024-11-26 | 9.8 Critical |
| HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php. | ||||
| CVE-2020-18432 | 1 Sem-cms | 1 Semcms | 2024-11-26 | 9.8 Critical |
| File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges. | ||||