Advisories · Weakness
CWE-616.
Every Advisory and CVE whose sources give the weakness CWE-616, newest first.
- CVSS 8.7 High
Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)
- plane
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 8.7 High
Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher
- perspective
- CWE-616
- CVSS 9.9 CriticalCritical · CVSS 9+
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Exe…
- CWE-616
- CVSS 5.4 Medium
WebErpMesv2 has a File Upload Validation Bypass Leading to RCE
- SMEWebify WebErpMesv2
- Unrestricted file upload
- CWE-616
- CVSS 5.4 Medium
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode.
- CWE-616
- CVSS 5.4 Medium
File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller.
- CWE-616
- CVSS 6.5 Medium
UnoPim Stored XSS : Cookie hijacking through Create User function
- Cross-site scripting (XSS)
- CWE-616
<0.1.5 · fixed in 0.1.5
GHSA-cgr4-c233-h733 · CVE-2024-52305 - CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v.
- CWE-616
- CVSS 6.5 Medium
File Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent management platform version S210, allows an attacker to obtain sensitive information via the uploadfile.p…
- Unrestricted file upload
- CWE-616
- CVSS 9.8 CriticalCritical · CVSS 9+
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
- CWE-616
- CVSS 7.2 High
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
- CWE-616