Export limit exceeded: 11766 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,766

Export CSV
CVE-2024-6132

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_options_validate' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-6127

BC Security Empire Path Traversal RCE

BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a malicious path.

CVSS 3.1 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Bcsecurity
Products
Empire
CVE-2024-6123

Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload

The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2019-25296

WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete

The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including, 9.642. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additionally, the attacker can also delete files on the server such as database configuration files, subsequently uploading their own database files.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2012-10039

ZEN Load Balancer Filelog Command Execution

ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.

CVSS 4.0 · 9.4 Critical EPSS 3.4% KEV · Not listed
Vendors
Zevenet
Products
Zen Load Balancer
CVE-2012-10042

Sflog! CMS 1.0 Arbitrary File Upload RCE

Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (admin:secret) and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling attackers to upload a PHP backdoor into a web-accessible directory (blogs/download/uploads/). Once uploaded, the file can be executed remotely, resulting in full remote code execution.

CVSS 4.0 · 8.7 High EPSS 1.7% KEV · Not listed
Vendors
Sflog
Products
Sflog
CVE-2012-10038

Auxilium RateMyPet Arbitrary File Upload RCE

Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
—
Products
—
CVE-2012-10037

PhpTax pfilez Parameter Exec Remote Code Injection

PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed
Vendors
—
Products
—
CVE-2014-125116

HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection

A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script remains accessible after deployment and fails to sanitize input before writing to the application’s config.php file. An unauthenticated attacker can inject arbitrary PHP code into config.php, which is later executed when the file is loaded. This allows attackers to achieve remote code execution on the server. Exploitation of this issue will overwrite the existing configuration, rendering the application non-functional.

CVSS 4.0 · 9.3 Critical EPSS 2.7% KEV · Not listed
Vendors
Hybridauth Social Login Project
Products
Hybridauth Social Login
CVE-2012-10036

Project Pier <= 0.8.8 Arbitrary File Upload RCE

Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 2.0% KEV · Not listed
Vendors
Projectpier
Products
Projectpier
CVE-2014-125115

Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE

An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.

CVSS 4.0 · 10 Critical EPSS 2.6% KEV · Not listed
Vendors
Artica Pandora Fms Pandorafms
Products
Pandora Fms Pandora Fms Pandora Fms
CVE-2012-10029

Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection

Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.

CVSS 4.0 · 8.6 High EPSS 3.5% KEV · Not listed
Vendors
Nagios
Products
Nagios Nagios Xi Xi and 1 more
CVE-2012-10028

Netwin SurgeFTP <= v23c8 Authenticated RCE

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.

CVSS 4.0 · 8.6 High EPSS 1.6% KEV · Not listed
Vendors
Netwin
Products
Surgeftp
CVE-2012-10025

WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.

CVSS 4.0 · 10 Critical EPSS 2.1% KEV · Not listed
Vendors
Accesspressthemes Advanced Custom Fields Wordpress
Products
Frontend Post Wordpress Plugin Advanced Custom Fields Wordpress Plugin Wordpress
CVE-2014-125118

eScan 5.5-2 Web Management Console Command Injection

A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter when processing login requests to login.php, allowing an authenticated attacker with a valid username to inject arbitrary commands via a specially crafted password value. Successful exploitation results in remote code execution. Privilege escalation to root is possible by abusing the runasroot utility with mwconf-level privileges.

CVSS 4.0 · 9.4 Critical EPSS 4.8% KEV · Not listed
Vendors
—
Products
—
CVE-2014-125119

WinRAR < 5.00 Filename Spoofing RCE

A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.

CVSS 4.0 · 8.4 High EPSS 2.0% KEV · Not listed
Vendors
Rarlab
Products
Winrar
CVE-2012-10041

WAN Emulator v2.3 Command Execution

WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec() with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary named dosu, which is vulnerable to command injection via its first argument. An attacker can exploit both flaws in sequence to achieve full remote code execution and escalate privileges to root.

CVSS 4.0 · 9.3 Critical EPSS 4.0% KEV · Not listed
Vendors
Wan Emulator
Products
Wan Emulator
CVE-2013-10066

Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.

CVSS 4.0 · 10 Critical EPSS 1.9% KEV · Not listed
Vendors
Kordil Edms Project
Products
Kordil Edms
CVE-2013-10058

Linksys Routers apply.cgi Remote Command Injection

An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.

CVSS 4.0 · 8.6 High EPSS 4.2% KEV · Not listed
Vendors
Linksys
Products
Wrt160nl Wrt160nv2
CVE-2013-10055

Havalite CMS Arbitary File Upload RCE

An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 1.7% KEV · Not listed
Vendors
Havalite
Products
Cms Havalite