Description
An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name parameter to /api/file_uploader.php or /actions/file_downloader.php.
Remediation
References
Related Vulnerabilities
WebLogic CVE-2019-2648 Vulnerability (CVE-2019-2648)
WordPress 4.1.x Multiple Vulnerabilities (4.1 - 4.1.31)
WordPress Plugin WooCommerce Social Login PHP Object Injection (2.6.2)
Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-0826)
WordPress Plugin Tutor LMS-eLearning and online course solution Security Bypass (2.6.2)