Export limit exceeded: 425860 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425860 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,632

Export CSV
CVE-2022-1033

Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Craterapp
Products
Crater
CVE-2022-1008

One Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload

The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Ocdi
Products
One Click Demo Import
CVE-2022-0962

Stored XSS viva .webma file upload in star7th/showdoc

Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0960

Stored XSS viva .properties file upload in star7th/showdoc

Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0951

File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc

File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0950

Unrestricted Upload of File with Dangerous Type in star7th/showdoc

Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0945

Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc

Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0930

File upload filter bypass leading to stored XSS in microweber/microweber

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0921

Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber

Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.

CVSS 3.1 · 6.7 Medium EPSS 2.2% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0912

Unrestricted Upload of File with Dangerous Type in microweber/microweber

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0863

WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)

The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.

CVSS 3.1 · 7.2 High EPSS 23.8% KEV · Not listed
Vendors
Wp Svg Icons Project
Products
Wp Svg Icons
CVE-2022-0687

Amelia < 1.0.46 - Manager+ RCE

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Tms-outsource
Products
Amelia
CVE-2022-0537

MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution

The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Mappresspro
Products
Mappress
CVE-2022-0499

Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sermon Browser Project
Products
Sermon Browser
CVE-2022-0472

Unrestricted Upload of File with Dangerous Type in jsdecena/laracom

Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Laracom Project
Products
Laracom
CVE-2022-0440

Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
Catchplugins
Products
Catch Themes Demo Import
CVE-2022-0415

Remote Command Execution in uploading repository file in gogs/gogs

Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

CVSS 3.1 · 8.8 High EPSS 65.9% KEV · Not listed
Vendors
Gogs
Products
Gogs
CVE-2022-0409

Unrestricted Upload of File with Dangerous Type in star7th/showdoc

Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0403

Library File Manager < 5.2.3 - Subscriber+ Arbitrary File Creation/Upload/Deletion

The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Wpjos
Products
Library File Manager
CVE-2022-0263

Unrestricted Upload of File with Dangerous Type in pimcore/pimcore

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Pimcore
Products
Pimcore