Total
3657 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-11674 | 2 Codeastro, Hospital Management System Project | 2 Hospital Management System, Hospital Management System | 2024-12-04 | 6.3 Medium |
| A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-11661 | 1 Codezips | 1 Free Exam Hall Seating Management System | 2024-12-04 | 4.3 Medium |
| A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file profile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The researcher submit confuses the vulnerability class of this issue. | ||||
| CVE-2023-32526 | 1 Trendmicro | 1 Mobile Security | 2024-12-04 | 6.5 Medium |
| Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32525. | ||||
| CVE-2024-51366 | 1 Omegat | 1 Omegat | 2024-12-04 | 9.8 Critical |
| An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .conf file. | ||||
| CVE-2023-32621 | 1 Wavlink | 2 Wl-wn531ax2, Wl-wn531ax2 Firmware | 2024-12-04 | 7.2 High |
| WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege. | ||||
| CVE-2024-11971 | 1 Jpress | 1 Jpress | 2024-12-03 | 3.5 Low |
| A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2023-33404 | 1 Blogengine | 1 Blogengine.net | 2024-12-03 | 9.8 Critical |
| An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code. | ||||
| CVE-2024-11979 | 1 Interinfo | 1 Dreammaker | 2024-12-03 | 9.8 Critical |
| DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. | ||||
| CVE-2023-4223 | 1 Chamilo | 1 Chamilo Lms | 2024-12-02 | 8.8 High |
| Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. | ||||
| CVE-2024-52476 | 1 Stefanbohacek | 1 Fediverse Embeds | 2024-12-02 | 10 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in stefanbohacek Fediverse Embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through 1.5.3. | ||||
| CVE-2023-39548 | 1 Nec | 2 Expresscluster X, Expresscluster X Singleserversafe | 2024-12-02 | 8.8 High |
| CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command. | ||||
| CVE-2023-36097 | 1 Funadmin | 1 Funadmin | 2024-12-02 | 9.8 Critical |
| funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install. | ||||
| CVE-2024-11082 | 1 Tumult | 1 Tumult Hype Animations | 2024-11-29 | 9.9 Critical |
| The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-52490 | 1 Pathomation | 1 Pathomation | 2024-11-29 | 10 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in Pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through 2.5.1. | ||||
| CVE-2018-0258 | 1 Cisco | 2 Prime Data Center Network Manager, Prime Infrastructure | 2024-11-29 | N/A |
| A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727. | ||||
| CVE-2024-51364 | 1 Gelcon | 1 Modbusmechanic | 2024-11-27 | 8.8 High |
| An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. | ||||
| CVE-2023-1721 | 1 Yoga Class Registration System Project | 1 Yoga Class Registration System | 2024-11-27 | 9.1 Critical |
| Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators. | ||||
| CVE-2023-36630 | 1 Mgt-commerce | 1 Cloudpanel | 2024-11-27 | 8.8 High |
| In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass. | ||||
| CVE-2020-20210 | 1 Bludit | 1 Bludit | 2024-11-27 | 8.8 High |
| Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. | ||||
| CVE-2023-34833 | 1 Thinkadmin | 1 Thinkadmin | 2024-11-27 | 6.1 Medium |
| An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file. | ||||