Total
4073 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-10521 | 1 Cmsmadesimple | 1 Cms Made Simple | 2026-06-17 | 4.0 MEDIUM | 2.7 LOW |
| In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory. | |||||
| CVE-2018-10469 | 1 B3log | 1 Symphony | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI. | |||||
| CVE-2018-10375 | 1 Dedecms | 1 Dedecms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code. | |||||
| CVE-2018-10173 | 1 Digitalguardian | 1 Management Console | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality. | |||||
| CVE-2018-1000839 | 1 Librehealth | 1 Librehealth Ehr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type. | |||||
| CVE-2018-1000811 | 1 Bludit | 1 Bludit | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code. | |||||
| CVE-2018-1000658 | 1 Limesurvey | 1 Limesurvey | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after commit 91d143230eb357260a19c8424b3005deb49a47f7 / version 3.14.4. | |||||
| CVE-2018-1000646 | 1 Librehealth | 1 Librehealth Ehr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in write files with malicious content and may lead to remote code execution. | |||||
| CVE-2018-1000619 | 1 Ovidentia | 1 Ovidentia | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Ovidentia version 8.4.3 and earlier contains a Unsanitized User Input vulnerability in utilit.php, bab_getAddonFilePathfromTg that can result in Authenticated Remote Code Execution. This attack appear to be exploitable via The attacker must have permission to upload addons. | |||||
| CVE-2018-1000544 | 3 Debian, Redhat, Rubyzip Project | 3 Debian Linux, Cloudforms, Rubyzip | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem.. | |||||
| CVE-2018-1000094 | 1 Cmsmadesimple | 1 Cms Made Simple | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension. | |||||
| CVE-2018-0686 | 1 Neo | 2 Debun Imap, Debun Pop | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors. | |||||
| CVE-2018-0645 | 1 Bit-part | 1 Mtappjquery | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors. | |||||
| CVE-2018-0587 | 1 Ultimatemember | 1 User Profile \& Membership | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors. | |||||
| CVE-2018-0571 | 1 Basercms | 1 Basercms | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files. | |||||
| CVE-2018-0568 | 1 Sitebridge | 1 Joruri Gw | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors. | |||||
| CVE-2018-0258 | 1 Cisco | 2 Prime Data Center Network Manager, Prime Infrastructure | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727. | |||||
| CVE-2017-9970 | 1 Schneider-electric | 1 Struxureon Gateway | 2026-06-17 | 9.0 HIGH | 7.2 HIGH |
| A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Uploading a zip which contains carefully crafted metadata allows for the file to be uploaded to any directory on the host machine information which could lead to remote code execution. | |||||
| CVE-2017-9840 | 1 Dolibarr | 1 Dolibarr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application. | |||||
| CVE-2017-9650 | 2 Automatedlogic, Carrier | 3 I-vu, Sitescan Web, Automatedlogic Webctrl | 2026-06-17 | 4.6 MEDIUM | 7.8 HIGH |
| An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code. | |||||