Total
3976 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-32526 | 1 Trendmicro | 1 Mobile Security | 2024-12-04 | 6.5 Medium |
| Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32525. | ||||
| CVE-2023-32621 | 1 Wavlink | 2 Wl-wn531ax2, Wl-wn531ax2 Firmware | 2024-12-04 | 7.2 High |
| WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege. | ||||
| CVE-2024-11971 | 1 Jpress | 1 Jpress | 2024-12-03 | 3.5 Low |
| A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2023-33404 | 1 Blogengine | 1 Blogengine.net | 2024-12-03 | 9.8 Critical |
| An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code. | ||||
| CVE-2023-4223 | 1 Chamilo | 1 Chamilo Lms | 2024-12-02 | 8.8 High |
| Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. | ||||
| CVE-2023-39548 | 1 Nec | 2 Expresscluster X, Expresscluster X Singleserversafe | 2024-12-02 | 8.8 High |
| CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command. | ||||
| CVE-2023-36097 | 1 Funadmin | 1 Funadmin | 2024-12-02 | 9.8 Critical |
| funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install. | ||||
| CVE-2018-0258 | 1 Cisco | 2 Prime Data Center Network Manager, Prime Infrastructure | 2024-11-29 | N/A |
| A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727. | ||||
| CVE-2023-1721 | 1 Yoga Class Registration System Project | 1 Yoga Class Registration System | 2024-11-27 | 9.1 Critical |
| Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators. | ||||
| CVE-2023-36630 | 1 Mgt-commerce | 1 Cloudpanel | 2024-11-27 | 8.8 High |
| In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass. | ||||
| CVE-2020-20210 | 1 Bludit | 1 Bludit | 2024-11-27 | 8.8 High |
| Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. | ||||
| CVE-2023-34833 | 1 Thinkadmin | 1 Thinkadmin | 2024-11-27 | 6.1 Medium |
| An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file. | ||||
| CVE-2023-34738 | 1 Chemex | 1 Chemex | 2024-11-27 | 9.8 Critical |
| Chemex through 3.7.1 is vulnerable to arbitrary file upload. | ||||
| CVE-2022-40896 | 2 Pygments, Redhat | 4 Pygments, Ansible Automation Platform, Satellite and 1 more | 2024-11-27 | 5.5 Medium |
| A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. | ||||
| CVE-2020-18432 | 1 Sem-cms | 1 Semcms | 2024-11-26 | 9.8 Critical |
| File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges. | ||||
| CVE-2023-48965 | 1 Thinkadmin | 1 Thinkadmin | 2024-11-26 | 8.8 High |
| An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file. | ||||
| CVE-2023-48930 | 1 Rockoa | 1 Xinhu | 2024-11-26 | 9.8 Critical |
| xinhu xinhuoa 2.2.1 contains a File upload vulnerability. | ||||
| CVE-2022-20743 | 1 Cisco | 1 Secure Firewall Management Center | 2024-11-26 | 6.5 Medium |
| A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to the web management interface of Cisco FMC Software. An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges. | ||||
| CVE-2023-50038 | 1 Textpattern | 1 Textpattern | 2024-11-26 | 8.8 High |
| There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. | ||||
| CVE-2018-15424 | 1 Cisco | 1 Identity Services Engine | 2024-11-26 | 4.7 Medium |
| A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server. | ||||