Total
2765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-28063 | 1 Articlecms Project | 1 Articlecms | 2021-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell. | |||||
| CVE-2018-12980 | 1 Wago | 8 762-3000, 762-3000 Firmware, 762-3001 and 5 more | 2021-05-20 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server. | |||||
| CVE-2020-20092 | 1 Articlecms Project | 1 Articlecms | 2021-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code. | |||||
| CVE-2021-29022 | 1 Invoiceplane | 1 Invoiceplane | 2021-05-19 | 5.0 MEDIUM | 5.3 MEDIUM |
| In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. | |||||
| CVE-2021-24254 | 1 College Publisher Import Project | 1 College Publisher Import | 2021-05-14 | 6.5 MEDIUM | 7.2 HIGH |
| The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack. | |||||
| CVE-2021-24253 | 1 Classyfrieds Project | 1 Classyfrieds | 2021-05-14 | 6.5 MEDIUM | 8.8 HIGH |
| The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE. | |||||
| CVE-2021-32094 | 1 Nsa | 1 Emissary | 2021-05-12 | 6.5 MEDIUM | 8.8 HIGH |
| U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files. | |||||
| CVE-2021-31737 | 1 Emlog | 1 Emlog | 2021-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php. | |||||
| CVE-2021-24236 | 1 Imagements Project | 1 Imagements | 2021-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE. | |||||
| CVE-2020-23083 | 1 Guojusoft | 1 Jeecg | 2021-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges by uploading a crafted file to the component "jeecgFormDemoController.do?commonUpload". | |||||
| CVE-2020-19113 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution. | |||||
| CVE-2020-21452 | 1 Uniview | 2 Isc2500-s, Isc2500-s Firmware | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker can upload malicious code via /Interface/DevManage/EC.php?cmd=upload | |||||
| CVE-2018-18475 | 1 Zohocorp | 1 Manageengine Opmanager | 2021-05-04 | 7.5 HIGH | 9.8 CRITICAL |
| Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. | |||||
| CVE-2021-24240 | 1 Aivahthemes | 1 Business Hours Pro | 2021-04-29 | 7.5 HIGH | 9.8 CRITICAL |
| The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability. | |||||
| CVE-2021-30209 | 1 Textpattern | 1 Textpattern | 2021-04-23 | 4.0 MEDIUM | 6.5 MEDIUM |
| Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions. | |||||
| CVE-2021-24220 | 1 Thrivethemes | 10 Focusblog, Ignition, Luxe and 7 more | 2021-04-22 | 6.4 MEDIUM | 9.1 CRITICAL |
| Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code. | |||||
| CVE-2020-29592 | 1 Orchardproject | 1 Orchard | 2021-04-22 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed (regardless of the file types allowed list in Media settings). | |||||
| CVE-2021-23280 | 1 Eaton | 3 Intelligent Power Manager, Intelligent Power Manager Virtual Appliance, Intelligent Power Protector | 2021-04-21 | 6.5 MEDIUM | 9.9 CRITICAL |
| Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability. | |||||
| CVE-2021-24223 | 1 N5 Upload Form Project | 1 N5 Upload Form | 2021-04-20 | 7.5 HIGH | 9.8 CRITICAL |
| The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5(uniqid(rand())), however, in the case of misconfigured servers with Directory listing enabled, accessing it is trivial. | |||||
| CVE-2021-24224 | 1 Easy-form-builder-by-bitware Project | 1 Easy-form-builder-by-bitware | 2021-04-20 | 6.5 MEDIUM | 8.8 HIGH |
| The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE. | |||||