deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10139
Published: 2024-10-19
Description: A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add_new_supplier.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/155be99b5314d97b276a7b30b9e6dec0; https://vuldb.com/?ctiid.280927
CVE: CVE-2024-10140
Published: 2024-10-19
Description: A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. Affected by this issue is some unknown functionality of the file /manage_supplier.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/b03bc3a330374a0581e51891d6105ed2; https://vuldb.com/?ctiid.280928
CVE: CVE-2024-10141
Published: 2024-10-19
Description: A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. This affects an unknown part of the component Session Handler. The manipulation of the argument SECRET_KEY leads to predictable from observable state. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-341
References: https://github.com/jsbroks/coco-annotator/issues/626; https://github.com/jsbroks/coco-annotator/issues/626#issue[PII_REDACTED]; https://vuldb.com/?ctiid.280929
CVE: CVE-2024-10142
Published: 2024-10-19
Description: A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /viewrequest.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://code-projects.org/; https://github.com/WrongDish/CVE/blob/main/xss6.md; https://vuldb.com/?ctiid.280930
CVE: CVE-2024-10153
Published: 2024-10-19
Description: A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file book-boat.php?bid=1 of the component Book a Boat Page. The manipulation of the argument bookingdatefrom/nopeople leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_book_boat_sqli.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280939
CVE: CVE-2024-10154
Published: 2024-10-19
Description: A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file status.php of the component Check Booking Status Page. The manipulation of the argument emailid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_status_sqli.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280940
CVE: CVE-2024-10155
Published: 2024-10-19
Description: A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file book-boat.php?bid=1 of the component Book a Boat Page. The manipulation of the argument phone_number leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_book_boat_xss.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280941
CVE: CVE-2024-10156
Published: 2024-10-19
Description: A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Sign In Page. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_admin_index_sqli.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280942
CVE: CVE-2024-10157
Published: 2024-10-19
Description: A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/password-recovery.php of the component Reset Your Password Page. The manipulation of the argument username/mobileno leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_admin_password_recovery_sqli.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280943
CVE: CVE-2024-10158
Published: 2024-10-19
Description: A vulnerability classified as problematic has been found in PHPGurukul Boat Booking System 1.0. Affected is the function session_start. The manipulation leads to session fixiation. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_session_fixation.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280944
CVE: CVE-2024-10159
Published: 2024-10-20
Description: A vulnerability classified as critical was found in PHPGurukul Boat Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/profile.php of the component My Profile Page. The manipulation of the argument sadminusername/fullname/emailid/mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "mobilenumber" to be affected. But it must be assumed that other parameters are affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_profile_sqli.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280945
CVE: CVE-2024-10160
Published: 2024-10-20
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Boat Booking System 1.0. Affected by this issue is some unknown functionality of the file /admin/bwdates-report-details.php of the component BW Dates Report Page. The manipulation of the argument fdate/tdate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "fdate" to be affected. But it must be assumed "tdate" is affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_bwdates_report_details_sqli.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280946
CVE: CVE-2024-10161
Published: 2024-10-20
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file change-image.php of the component Update Boat Image Page. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_change_image_file_upload_rce.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280947
CVE: CVE-2024-10162
Published: 2024-10-20
Description: A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-subadmin.php of the component Edit Subdomain Details Page. The manipulation of the argument sadminusername/fullname/emailid/mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "mobilenumber" to be affected. But it must be assumed that other parameters are affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_edit_subadmin_sqli.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280948
CVE: CVE-2024-10163
Published: 2024-10-20
Description: A vulnerability was found in SourceCodester Sentiment Based Movie Rating System 1.0. It has been classified as critical. Affected is an unknown function of the file /msrps/movie_details.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure mentions a slightly changed product name.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/[PII_REDACTED]/CVE-report/blob/main/Sourcecodester-SQLi-Sentiment-Based-Moive-Rating.md; https://vuldb.com/?ctiid.280950; https://vuldb.com/?id.280950
CVE: CVE-2024-10165
Published: 2024-10-20
Description: A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file deletecustcom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/14; https://vuldb.com/?ctiid.280951; https://vuldb.com/?id.280951
CVE: CVE-2024-10166
Published: 2024-10-20
Description: A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file checkuser.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/15; https://vuldb.com/?ctiid.280952; https://vuldb.com/?id.280952
CVE: CVE-2024-10167
Published: 2024-10-20
Description: A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/16; https://vuldb.com/?ctiid.280953; https://vuldb.com/?id.280953
CVE: CVE-2024-10169
Published: 2024-10-20
Description: A vulnerability classified as critical was found in code-projects Hospital Management System 1.0. This vulnerability affects unknown code of the file change-password.php. The manipulation of the argument cpass leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/RainFo666/cve/issues/1; https://vuldb.com/?ctiid.280954
CVE: CVE-2024-10170
Published: 2024-10-20
Description: A vulnerability, which was classified as critical, has been found in code-projects Hospital Management System 1.0. This issue affects some unknown processing of the file get_doctor.php. The manipulation of the argument specilizationid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/zer0-1s/cve/issues/1; https://vuldb.com/?ctiid.280955
CVE: CVE-2024-10171
Published: 2024-10-20
Description: A vulnerability, which was classified as critical, was found in code-projects Blood Bank System up to 1.0. Affected is an unknown function of the file /admin/massage.php. The manipulation of the argument bid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/cdl00/cve/blob/main/sql8-message-book.md; https://vuldb.com/?ctiid.280956
CVE: CVE-2024-10173
Published: 2024-10-20
Description: A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console Module. The manipulation with the input /;login leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-863
References: https://github.com/didi/DDMQ/issues/37; https://github.com/didi/DDMQ/issues/37#issue[PII_REDACTED]; https://vuldb.com/?ctiid.280957
CVE: CVE-2024-10191
Published: 2024-10-20
Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/book-details.php of the component Booking Details Page. The manipulation of the argument Official Remark leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_booking_details_xss.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280965
CVE: CVE-2024-10192
Published: 2024-10-20
Description: A vulnerability has been found in PHPGurukul IFSC Code Finder Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file search.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_ifsc_code_finder_search_xss.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.280966
CVE: CVE-2024-10193
Published: 2024-10-20
Description: A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://docs.google.com/document/d/13XWnFITW31u5J8HeQj8Zm-7oLt-M1DtQ/; https://vuldb.com/?ctiid.280967; https://vuldb.com/?id.280967
CVE: CVE-2024-10194
Published: 2024-10-20
Description: A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been classified as critical. Affected is the function Goto_chidx of the file login.cgi of the component Front-End Authentication Page. The manipulation of the argument wlanUrl leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://docs.google.com/document/d/1PodIMRe1f0Ql83jUXV5VIoc-Xsf9VC1K; https://vuldb.com/?ctiid.280968; https://vuldb.com/?id.280968
CVE: CVE-2024-48049
Published: 2024-10-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder mighty-builder allows Stored XSS.This issue affects Mighty Builder: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mighty-builder/vulnerability/wordpress-mighty-builder-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49286
Published: 2024-10-20
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inclusion.This issue affects SSV Events: from n/a through <= 3.2.7.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/ssv-events/vulnerability/wordpress-ssv-events-plugin-3-2-7-local-file-inclusion-to-rce-vulnerability?_s_id=cve
CVE: CVE-2024-49323
Published: 2024-10-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahriar Alam All in One Slider all-in-one-slider allows Reflected XSS.This issue affects All in One Slider: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-slider/vulnerability/wordpress-all-in-one-slider-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49328
Published: 2024-10-20
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://patchstack.com/database/Wordpress/Plugin/rest-api-fns/vulnerability/wordpress-wp-rest-api-fns-plugin-plugin-1-0-0-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-49334
Published: 2024-10-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider jlayer-parallax-slider-wp allows Reflected XSS.This issue affects jLayer Parallax Slider: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jlayer-parallax-slider-wp/vulnerability/wordpress-jlayer-parallax-slider-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49604
Published: 2024-10-20
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://patchstack.com/database/Wordpress/Plugin/wp-registration/vulnerability/wordpress-simple-user-registration-plugin-5-5-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-49606
Published: 2024-10-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Google Map Locations google-map-locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/google-map-locations/vulnerability/wordpress-google-map-locations-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49611
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in paxmanpwnz Product Website Showcase product-websites-showcase allows Upload a Web Shell to a Web Server.This issue affects Product Website Showcase: from n/a through <= 1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/product-websites-showcase/vulnerability/wordpress-product-website-showcase-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49626
Published: 2024-10-20
Description: Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through <= 1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/shipyaari-shipping-managment/vulnerability/wordpress-shipyaari-shipping-management-plugin-1-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49630
Published: 2024-10-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems WP Education wp-education allows Stored XSS.This issue affects WP Education: from n/a through <= 1.2.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-education/vulnerability/wordpress-wp-education-for-elementor-plugin-1-2-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49631
Published: 2024-10-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abdul Kader Easy Addons for Elementor easy-addons-for-elementor allows Stored XSS.This issue affects Easy Addons for Elementor: from n/a through <= 1.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-addons-for-elementor/vulnerability/wordpress-easy-addons-for-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-10195
Published: 2024-10-20
Description: A vulnerability was found in Tecno 4G Portable WiFi TR118 V[PII_REDACTED]0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QB; https://vuldb.com/?ctiid.280969; https://vuldb.com/?id.280969
CVE: CVE-2024-49324
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in sovratecdev Sovratec Case Management sovratec-case-management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through <= 1.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/sovratec-case-management/vulnerability/wordpress-sovratec-case-management-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49326
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Vasileios Kerasiotis Affiliator affiliator-lite allows Upload a Web Shell to a Web Server.This issue affects Affiliator: from n/a through <= 2.1.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/affiliator-lite/vulnerability/wordpress-affiliator-plugin-2-1-3-arbitrary-file-upload-vulnerability?_s_id=cve