Все уязвимости

BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8

Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0...

SourceCodester Online Food Ordering System add_food.php unrestricted upload

GouGuOA Api.php chunkUpload unrestricted upload

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal

SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data

Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload

Docat has Arbitrary File Upload exists in Upload API

37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload

Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

Host Administrator Path Containment Bypass in Progress WS_FTP Server

SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)

Arbitrary File Upload in Protectel

Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management

KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload

WBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload

n8n before 1.123.67 Arbitrary File Write via Edit Image Node

Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload

prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload

Parse Server 9.0.0 Stored XSS via malformed Content-Type

Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin