Description
An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name parameter to /api/file_uploader.php or /actions/file_downloader.php.
Remediation
References
Related Vulnerabilities
YetiForce CRM Improper Input Validation Vulnerability (CVE-2021-4117)
WordPress Plugin WP Frontend Profile Multiple Vulnerabilities (0.2.1)
WebLogic CVE-2021-35620 Vulnerability (CVE-2021-35620)
Liferay DXP Incorrect Default Permissions Vulnerability (CVE-2024-25605)
WordPress Plugin MailChimp List Subscribe Form Multiple Unspecified Vulnerabilities (1.1)