Total
2982 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-27140 | 1 Express-fileupload Project | 1 Express-fileupload | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload middleware is not responsible for an application's business logic (e.g., determining whether or how a file should be renamed). | |||||
| CVE-2022-27139 | 1 Ghost | 1 Ghost | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploading of SVG files to Ghost does not represent a remote code execution vulnerability. SVGs are not executable on the server, and may only execute javascript in a client's browser - this is expected and intentional functionality | |||||
| CVE-2022-27131 | 1 Zbzcms | 1 Zbzcms | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-27129 | 1 Zbzcms | 1 Zbzcms | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-27115 | 2 Microsoft, Std42 | 2 Windows, Elfinder | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload. | |||||
| CVE-2022-27064 | 1 Musical World Project | 1 Musical World | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-27061 | 1 Aerocms Project | 1 Aerocms | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-27047 | 1 Moguit | 1 Mogu Blog Cms | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation. | |||||
| CVE-2022-26965 | 1 Pluck-cms | 1 Pluck | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution. | |||||
| CVE-2022-26645 | 1 Banking System Project | 1 Banking System | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function. | |||||
| CVE-2022-26630 | 1 Jellycms | 1 Jellycms | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php. | |||||
| CVE-2022-26627 | 1 Online Project Time Management System Project | 1 Online Project Time Management System | 2024-11-21 | 6.8 MEDIUM | 8.8 HIGH |
| Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file. | |||||
| CVE-2022-26619 | 1 Halo | 1 Halo | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. | |||||
| CVE-2022-26607 | 1 Baigo | 1 Baigo Cms | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP file. | |||||
| CVE-2022-26605 | 1 Dascomsoft | 1 Eziosuite | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality. | |||||
| CVE-2022-26521 | 1 Abantecart | 1 Abantecart | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type). | |||||
| CVE-2022-26149 | 1 Modx | 1 Revolution | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator. | |||||
| CVE-2022-25602 | 1 Expresstech | 1 Responsive Menu | 2024-11-21 | 6.5 MEDIUM | 8.3 HIGH |
| Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7). | |||||
| CVE-2022-25581 | 1 Classcms | 1 Classcms | 2024-11-21 | 6.8 MEDIUM | 7.8 HIGH |
| Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file. | |||||
| CVE-2022-25495 | 1 Cuppacms | 1 Cuppacms | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file. | |||||