CVE-2011-10010

QuickShare File Server 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated users can exploit this flaw by submitting crafted sequences to access or write files outside the intended virtual directory. When the...

OESA-2025-2000 python-werkzeug security update

A comprehensive WSGI web application library Security Fixes: Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal...

OESA-2025-1999 python-werkzeug security update

A comprehensive WSGI web application library Security Fixes: Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal...

CVE-2025-6679

The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote co...

CVE-2025-6679

CVE-2025-6679 concerns the WordPress Bit Form builder plugin. Affected: Bit Form builder for WordPress, versions up to and including 2.20.4. Issue: missing file type validation enables unauthenticated arbitrary file uploads via an advanced file upload element, potentially enabling remote code exe...

VulnCheck KEV: CVE-2025-7441

The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...

PT-2025-33446 · WordPress · Bit Form Builder

Name of the Vulnerable Software and Affected Versions: Bit Form builder plugin for WordPress versions up to and including 2.20.4 Description: The Bit Form builder plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation. This allows unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2017-6922

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to...

CVE-2025-3831

Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties...

CVE-2025-24775 WordPress Forms <= 2.9.0 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through = 2.9.0...

Cross-Site Scripting

Copyparty is vulnerable to reflected Cross-Site Scripting XSS. The vulnerability is due to improper escaping of user-supplied input in the filter parameter on the recent uploads page, which is reflected into a...

litemall 代码问题漏洞

litemall is a small mall system for linlinjava individual developers. A code issue vulnerability exists in litemall 1.8.0 and earlier versions, which stems from an incorrect operation of the File parameter File in the file...

HCL Connections Docs 安全漏洞

HCL Connections Docs is a documentation site of HCL India. A security vulnerability exists in HCL Connections Docs version 2.0.2, which stems from improper validation of uploaded documents and could result in a denial of service due to resource exhaustion...

CVE-2012-10054

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter,...

CVE-2011-10010

QuickShare File Server 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated users can exploit this flaw by submitting crafted sequences to access or write files outside the intended virtual directory. When the...

CVE-2012-10054

Umbraco CMS

CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter,...

CVE-2011-10010

The CVE-2011-10010 entry affects QuickShare File Server 1.2.1 and describes a path traversal flaw in the FTP service caused by improper sanitation of user-supplied file paths. Authenticated users can submit crafted sequences to access/write files outside the virtual directory, and when the Writab...

CVE-2012-10056

CVE-2012-10056 affects PHP Volunteer Management System v1.0.2. An arbitrary file upload vulnerability in the document upload feature allows authenticated users to upload files to mods/documents/uploads/ without file-type checks; the directory is publicly accessible and execution controls are miss...

CVE-2012-10056 PHP Volunteer Management System 1.0.2 Arbitrary File Upload

PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessib...