Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3379 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-19302 1 Vaethink 1 Vaethink 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to ".php".
CVE-2020-19267 1 Dswjcms Project 1 Dswjcms 2024-11-21 9.8 Critical
An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2020-19228 1 Bludit 1 Bludit 2024-11-21 7.2 High
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.
CVE-2020-19138 1 Dotcms 1 Dotcms 2024-11-21 9.8 Critical
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java".
CVE-2020-19113 1 Projectworlds 1 Online Book Store Project In Php 2024-11-21 9.8 Critical
Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution.
CVE-2020-18912 1 Earcms 1 Ear 2024-11-21 9.8 Critical
An issue found in Earcms Ear App v.20181124 allows a remote attacker to execute arbitrary code via the uload/index-uplog.php.
CVE-2020-18886 1 Phpmywind 1 Phpmywind 2024-11-21 7.2 High
Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.
CVE-2020-18879 1 Bludit 1 Bludit 2024-11-21 9.8 Critical
Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'.
CVE-2020-18704 1 Fusionbox 1 Widgy 2024-11-21 9.8 Critical
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.
CVE-2020-18462 1 Aikcms 1 Aikcms 2024-11-21 7.2 High
File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not verify the uploaded file.
CVE-2020-18261 1 Ed01-cms Project 1 Ed01-cms 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands.
CVE-2020-18166 1 Laobancms 1 Laobancms 2024-11-21 9.8 Critical
Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc".
CVE-2020-18114 1 Dedecms 1 Dedecms 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.
CVE-2020-17462 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 7.8 High
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
CVE-2020-17452 1 Flatcore 1 Flatcore 2024-11-21 7.2 High
flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
CVE-2020-15839 1 Liferay 2 Digital Experience Platform, Liferay Portal 2024-11-21 6.5 Medium
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
CVE-2020-15649 2 Google, Mozilla 2 Android, Firefox Esr 2024-11-21 5.5 Medium
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
CVE-2020-15645 1 Marvell 1 Qconvergeconsole 2024-11-21 8.8 High
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the getFileFromURL method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10553.
CVE-2020-15488 1 Re-desk 1 Re\ 2024-11-21 7.5 High
Re:Desk 2.3 allows insecure file upload.
CVE-2020-15277 1 Basercms 1 Basercms 2024-11-21 7.2 High
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.