Total
3699 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-2180 | 1 Greyd | 1 Greyd.suite | 2024-11-21 | 9.8 Critical |
| The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE). | ||||
| CVE-2022-2128 | 1 Trudesk Project | 1 Trudesk | 2024-11-21 | 9.8 Critical |
| Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. | ||||
| CVE-2022-2111 | 1 Inventree Project | 1 Inventree | 2024-11-21 | 8.8 High |
| Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. | ||||
| CVE-2022-2046 | 1 Wpwax | 1 Directorist | 2024-11-21 | 4.9 Medium |
| The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations. | ||||
| CVE-2022-29725 | 1 Creatiwity | 1 Witycms | 2024-11-21 | 8.8 High |
| An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file. | ||||
| CVE-2022-29655 | 1 Wedding Management System Project | 1 Wedding Management System | 2024-11-21 | 7.2 High |
| An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | ||||
| CVE-2022-29651 | 1 Online Food Ordering System Project | 1 Online Food Ordering System | 2024-11-21 | 7.2 High |
| An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | ||||
| CVE-2022-29637 | 1 Iminho | 1 Mindoc | 2024-11-21 | 7.8 High |
| An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file. | ||||
| CVE-2022-29632 | 1 Roncoo | 1 Roncoo-education | 2024-11-21 | 9.8 Critical |
| An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file. | ||||
| CVE-2022-29624 | 1 Tpcms Project | 1 Tpcms | 2024-11-21 | 8.8 High |
| An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file. | ||||
| CVE-2022-29622 | 1 Formidable Project | 1 Formidable | 2024-11-21 | 9.8 Critical |
| An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability. | ||||
| CVE-2022-29354 | 1 Keystonejs | 1 Keystone | 2024-11-21 | 9.8 Critical |
| An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file. | ||||
| CVE-2022-29353 | 1 Graphql-upload Project | 1 Graphql-upload | 2024-11-21 | 9.8 Critical |
| An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename. | ||||
| CVE-2022-29351 | 1 Tiddlywiki | 1 Tiddlywiki5 | 2024-11-21 | 9.8 Critical |
| An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here. | ||||
| CVE-2022-29347 | 1 Web\@rchiv Project | 1 Web\@rchiv | 2024-11-21 | 9.8 Critical |
| An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file. | ||||
| CVE-2022-29318 | 1 Car Rental Management System Project | 1 Car Rental Management System | 2024-11-21 | 7.2 High |
| An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | ||||
| CVE-2022-29001 | 1 Springbootmovie Project | 1 Springbootmovie | 2024-11-21 | 7.2 High |
| In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability | ||||
| CVE-2022-28927 | 1 Subconverter Project | 1 Subconverter | 2024-11-21 | 9.8 Critical |
| A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters. | ||||
| CVE-2022-28863 | 1 Nokia | 1 Netact | 2024-11-21 | 8.8 High |
| An issue was discovered in Nokia NetAct 22. A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the operation=upload value. | ||||
| CVE-2022-28606 | 1 Bosscms | 1 Bosscms | 2024-11-21 | 9.8 Critical |
| An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server. | ||||