CVE-2023-5957

HIGH Year: 2023
CVSS v3 Score
7.2
High
Weakness Type
CWE-434
View all →

Vulnerability Description

The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.

Related Vulnerabilities

CVE-2011-2933

HIGH
CVSS:7.2(High)

An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions...

CWE-4342011

CVE-2014-9619

HIGH
CVSS:7.2(High)

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with ad...

CWE-4342014

CVE-2016-6104

HIGH
CVSS:7.2(High)

IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute a...

CWE-4342016

CVE-2016-9268

HIGH
CVSS:7.2(High)

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitra...

CWE-4342016

CVE-2017-1000119

HIGH
CVSS:7.2(High)

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

CWE-4342017

CVE-2017-11154

HIGH
CVSS:7.2(High)

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

CWE-4342017