Alertas de Seguridad de la Información

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset …

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP t…

W (vincent-peugnet/wcms) versión 3.18.0 y anteriores contiene una vulnerabilidad de ejecución remota de código (RCE) que permite a editores autenticados escribir archivos arbitrarios mediante la validación insuficiente en POST /api/v0/media/upload/[*:path]. Los atacantes pueden cargar archivos PHP ejecutables, utilizar secuencias codificadas ../ para escribir fuera del directorio de medios, y eliminar archivos arbitrarios. Esta vulnerabilidad afecta principalmente a plataformas de gestión de contenidos desplegadas en servidores web de empresas mexicanas y latinoamericanas.

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token pa…

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient of the file php/controller.php. Executing a manipulation of the argument img can lead to unrestricted upload. The attack may be launched remo…

YesWiki versiones anteriores a 4.6.7 presentan una vulnerabilidad de carga de archivos no restringida que permite a administradores autenticados ejecutar código PHP malicioso en el servidor mediante la importación de CSV en Bazar. Un atacante puede importar un archivo CSV con referencias a URLs PHP remotas que se guardan sin validación de extensión y se ejecutan como código del lado del servidor, comprometiendo la integridad del sitio web y los datos alojados.

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file_path, which is then used without validation to attach a file to the form's notification email (arbitrary file…

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to b…