Linux Distros Unpatched Vulnerability : CVE-2023-32637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload...

CVE-2025-52353

CVE-2025-52353 affects Badaso CMS 2.9.11 where the Media Manager file-upload endpoint bypasses content-type validation, allowing authenticated users to upload files containing embedded PHP code. When such a file is accessed via its URL, the server executes the PHP payload, enabling arbitrary syst...

PT-2025-34745

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Information System version 1.0 Description: A vulnerability exists in SourceCodester Human Resource Information System 1.0, specifically within an unknown functionality of the /Superadmin...

CVE-2025-52353

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload,...

Badaso 安全漏洞

Badaso is an open source Laravel Vue headless CMS from Uasoft Open Source. A security vulnerability exists in Badaso version 2.9.11, which stems from Media Manager allowing the upload of files containing PHP code, which could lead to arbitrary code execution...

Linux Distros Unpatched Vulnerability : CVE-2019-18180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Check for filenames with overly long extensions in PostMaster sending in email or uploading files e.g. attaching files to mails of OTRS Community Editi...

CVE-2025-52130

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...

CVE-2025-53120 Securden Unified PAM Path Traversal In File Upload

A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration and web root directories, achieving remote code execution on the Unified PAM server...

CVE-2025-53120 Securden Unified PAM Path Traversal In File Upload

A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration and web root directories, achieving remote code execution on the Unified PAM server...

CVE-2025-54300

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads...

CVE-2025-54300 Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads...

CVE-2025-54300

CVE-2025-54300 affects the Quantum Manager component for Joomla, versions 1.0.0–3.2.0. The root cause is an unsanitized SVG upload mechanism that allows stored XSS. The CVSS 4.0 vector indicates Network access, high impact on confidentiality and availability, and user interaction not required but...

CVE-2025-43766

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environme...

lemon 安全漏洞

lemon is an open source OA by Xu Huisheng individual developer. A security vulnerability exists in lemon 1.13.0 and earlier versions, which originates from the improper handling of the Upload parameter in the uploadImage function in the file CmsArticleController.java, which may lead to unlimited...

PT-2025-34677 · Unknown · Unified Pam

Name of the Vulnerable Software and Affected Versions: Unified PAM server affected versions not specified Description: A path traversal vulnerability exists in the unauthenticated upload functionality. This allows a malicious actor to upload binaries and scripts to the server’s configuration and...

Yifang CMS 安全漏洞

Yifang CMS is a PHP enterprise website development and construction management system from China Yifang Company. A security vulnerability exists in Yifang CMS 2.0.5 and earlier versions, which originates from the improper handling of the File parameter in the mergeMultipartUpload function in the...

GreenCMS 安全漏洞

GreenCMS is an open source content management system CMS developed by GreenCMS based on ThinkPHP. A security vulnerability exists in GreenCMS 2.3.0603 and earlier versions, which stems from the incorrect operation of the parameter upload in the file/index.php?m=admin&c=media&a=fileconnect,...

Securden Unified PAM 安全漏洞

Securden Unified PAM is a privileged access management software from Securden, Inc. A security vulnerability exists in Securden Unified PAM that stems from an unauthenticated file upload feature that could lead to malicious file uploads...

Prompt-In-Content Attacks: Exploiting Uploaded Inputs to Hijack LLM Behavior

Large Language Models LLMs are widely deployed in applications that accept user-submitted content, such as uploaded documents or pasted text, for tasks like summarization and question answering. In this paper, we identify a new class of attacks, prompt in content injection, where adversarial...

Linux Distros Unpatched Vulnerability : CVE-2017-6100

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP. CVE-2017-6100 Note that Nessus relies on the presence of the package a...