Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3762 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-32621 1 Wavlink 2 Wl-wn531ax2, Wl-wn531ax2 Firmware 2024-12-04 7.2 High
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.
CVE-2024-11971 1 Jpress 1 Jpress 2024-12-03 3.5 Low
A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-33404 1 Blogengine 1 Blogengine.net 2024-12-03 9.8 Critical
An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.
CVE-2024-11979 1 Interinfo 1 Dreammaker 2024-12-03 9.8 Critical
DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
CVE-2023-4223 1 Chamilo 1 Chamilo Lms 2024-12-02 8.8 High
Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
CVE-2024-52476 1 Stefanbohacek 1 Fediverse Embeds 2024-12-02 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in stefanbohacek Fediverse Embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through 1.5.3.
CVE-2023-39548 1 Nec 2 Expresscluster X, Expresscluster X Singleserversafe 2024-12-02 8.8 High
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
CVE-2023-36097 1 Funadmin 1 Funadmin 2024-12-02 9.8 Critical
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
CVE-2024-11082 1 Tumult 1 Tumult Hype Animations 2024-11-29 9.9 Critical
The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2024-52490 1 Pathomation 1 Pathomation 2024-11-29 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through 2.5.1.
CVE-2018-0258 1 Cisco 2 Prime Data Center Network Manager, Prime Infrastructure 2024-11-29 N/A
A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727.
CVE-2024-51364 1 Gelcon 1 Modbusmechanic 2024-11-27 8.8 High
An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file.
CVE-2023-1721 1 Yoga Class Registration System Project 1 Yoga Class Registration System 2024-11-27 9.1 Critical
Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.
CVE-2023-36630 1 Mgt-commerce 1 Cloudpanel 2024-11-27 8.8 High
In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
CVE-2020-20210 1 Bludit 1 Bludit 2024-11-27 8.8 High
Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.
CVE-2023-34833 1 Thinkadmin 1 Thinkadmin 2024-11-27 6.1 Medium
An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.
CVE-2023-34738 1 Chemex 1 Chemex 2024-11-27 9.8 Critical
Chemex through 3.7.1 is vulnerable to arbitrary file upload.
CVE-2022-40896 2 Pygments, Redhat 4 Pygments, Ansible Automation Platform, Satellite and 1 more 2024-11-27 5.5 Medium
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
CVE-2024-9942 2 Dasinfomedia, Mojoomla 2 Wpgym Gym Management System, Wordpress Gym Management System 2024-11-26 9.8 Critical
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload() function in all versions up to, and including, 67.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2020-18432 1 Sem-cms 1 Semcms 2024-11-26 9.8 Critical
File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges.