Total
3312 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-11138 | 1 Dedecms | 1 Dedecms | 2024-12-10 | 3.3 LOW | 2.7 LOW |
| A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-1875 | 1 Razormist | 1 Complaint Management System | 2024-12-10 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown processing of the file users/register-complaint.php of the component Lodge Complaint Section. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254723. | |||||
| CVE-2020-20919 | 1 Pluck-cms | 1 Pluck | 2024-12-10 | N/A | 7.2 HIGH |
| File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file. | |||||
| CVE-2020-20735 | 1 8cms | 1 Ljcms | 2024-12-10 | N/A | 9.8 CRITICAL |
| File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter. | |||||
| CVE-2020-20718 | 1 Pluck-cms | 1 Pluckcms | 2024-12-10 | N/A | 9.8 CRITICAL |
| File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file() parameter. | |||||
| CVE-2020-21174 | 1 Feehi | 1 Feehicms | 2024-12-10 | N/A | 9.8 CRITICAL |
| File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function. | |||||
| CVE-2020-21474 | 1 Nucleuscms | 1 Nucleuscms | 2024-12-10 | N/A | 9.8 CRITICAL |
| File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter. | |||||
| CVE-2024-42375 | 1 Sap | 1 Business Objects Business Intelligence Platform | 2024-12-10 | N/A | 4.3 MEDIUM |
| SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. | |||||
| CVE-2024-41731 | 1 Sap | 1 Business Objects Business Intelligence Platform | 2024-12-10 | N/A | 3.1 LOW |
| SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. | |||||
| CVE-2024-28166 | 1 Sap | 1 Business Objects Business Intelligence Platform | 2024-12-10 | N/A | 3.7 LOW |
| SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. | |||||
| CVE-2024-4927 | 1 Oretnom23 | 1 Simple Online Bidding System | 2024-12-09 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=save_product. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264463. | |||||
| CVE-2020-21489 | 1 Feehi | 1 Feehicms | 2024-12-09 | N/A | 9.8 CRITICAL |
| File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component. | |||||
| CVE-2020-21325 | 1 Wuzhicms | 1 Wuzhicms | 2024-12-09 | N/A | 8.8 HIGH |
| An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file. | |||||
| CVE-2024-53822 | 2024-12-09 | N/A | 10.0 CRITICAL | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. | |||||
| CVE-2024-1819 | 1 Codeastro | 1 Membership Management System | 2024-12-07 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the component Add Members Tab. The manipulation of the argument Member Photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254607. | |||||
| CVE-2024-1818 | 1 Codeastro | 1 Membership Management System | 2024-12-07 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /uploads/ of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254606 is the identifier assigned to this vulnerability. | |||||
| CVE-2024-53811 | 2024-12-06 | N/A | 6.6 MEDIUM | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in POSIMYTH WDesignkit allows Upload a Web Shell to a Web Server.This issue affects WDesignkit: from n/a through 1.0.40. | |||||
| CVE-2024-10578 | 2024-12-06 | N/A | 8.8 HIGH | ||
| The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_action_for_notice() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins that can be leveraged to exploit other vulnerabilities. | |||||
| CVE-2023-32525 | 1 Trendmicro | 1 Mobile Security | 2024-12-05 | N/A | 6.5 MEDIUM |
| Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32526. | |||||
| CVE-2024-51548 | 2024-12-05 | N/A | 9.9 CRITICAL | ||
| Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 | |||||