https://vulnerability.circl.lu/sightings/feed 2026-05-07T12:28:26.648442+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/db8b9c0b-3999-48c5-838f-7244be0dee29/export 2026-05-07T12:28:27.047582+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "db8b9c0b-3999-48c5-838f-7244be0dee29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23814", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/34231", "content": "\u203c CVE-2021-23814 \u203c\n\nThis affects the package unisharp/laravel-filemanager from 0.0.0. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload window - Upload an image file, then capture the request - Edit the request contents with a malicious file (webshell) - Enter the path of file uploaded on URL - Remote Code Execution **Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-17T22:37:44.000000Z"} 2021-12-17T22:37:44+00:00