Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (4794 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-43226 1 Dedecms 1 Dedecms 2024-09-23 8.8 High
An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-42462 1 Glpi-project 1 Glpi 2024-09-23 7.7 High
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.
CVE-2022-47186 1 Generex 3 Cs141, Cs141 Firmware, Ups-cs141 2024-09-23 7.5 High
There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.
CVE-2023-5185 1 Projectworlds 1 Gym Management System Project 2024-09-23 9.1 Critical
Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
CVE-2023-43740 1 Projectworlds 1 Online Book Store Project 2024-09-23 8.8 High
Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of admin_edit.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
CVE-2022-47893 1 Riello-ups 2 Netman 204, Netman 204 Firmware 2024-09-23 10 Critical
There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.
CVE-2023-44008 1 Mojoportal 1 Mojoportal 2024-09-23 9.8 Critical
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.
CVE-2023-5227 1 Phpmyfaq 1 Phpmyfaq 2024-09-23 9.8 Critical
Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CVE-2023-44009 1 Mojoportal 1 Mojoportal 2024-09-23 9.8 Critical
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.
CVE-2023-44974 1 Emlog 1 Emlog 2024-09-23 9.8 Critical
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-44973 1 Emlog 1 Emlog 2024-09-20 9.8 Critical
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-43838 1 Personal-management-system 1 Personal Management System 2024-09-20 7.8 High
An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.
CVE-2024-6948 1 Gargaj 1 Wuhu 2024-09-20 6.3 Medium
A vulnerability classified as critical has been found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected is an unknown function of the file /slideeditor.php of the component Slide Editor. The manipulation of the argument newSlideFile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-272070 is the identifier assigned to this vulnerability.
CVE-2024-46377 1 Sourcecodester 1 Best House Rental Management System 2024-09-20 9.8 Critical
Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php.
CVE-2024-46373 1 Dedecms 1 Dedecms 2024-09-20 8.8 High
Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.
CVE-2024-2381 1 Ali2woo 1 Aliexpress Dropshipping With Alinext 2024-09-20 8.8 High
The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2023-43269 1 Pigcms 1 Pigcms 2024-09-19 9.8 Critical
pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.
CVE-2023-4097 1 Qsige 1 Qsige 2024-09-19 8.8 High
The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log into the application with a valid username.
CVE-2023-4817 1 Icpdas 2 Et-7060, Et-7060 Firmware 2024-09-19 7.2 High
This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire device.
CVE-2023-43321 1 Dcnetworks 2 Dcfw-1800-sdc, Dcfw-1800-sdc Firmware 2024-09-19 8.8 High
File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the wget function in the /sbin/cloudadmin.sh component.