CVE-2025-4406 wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

ProcessMaker 代码问题漏洞

ProcessMaker is a Php-written site builder for business process management BPM and workflow management from ProcessMaker Inc. in the United States. A security vulnerability exists in ProcessMaker versions prior to 3.5.4 that stems from improper handling of plugin uploads, which could lead to remo...

PT-2025-28970 · WordPress · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum plugin for WordPress versions prior to 2.4.6 Description: The wpForo Forum plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. Insufficient input sanitization and output escaping allow...

IBM Analytics Content Hub 代码问题漏洞

IBM Analytics Content Hub is a clean streaming experience from International Business Machines IBM that visualizes relevant analytics by extracting content from IBM and other analytics providers. A code issue vulnerability exists in IBM Analytics Content Hub versions 2.0, 2.1, 2.2, and 2.3 that...

GHSA-4VC8-WVHW-M5GV Juju allows arbitrary executable uploads via authenticated endpoint without authorization

Summary You can affect the agent binaries used in a Juju controller and the code that is run in the binaries by simply having a user account on a controller. You aren't required to have a model or any permissions. This just requires a user account in the controller database. Details Because of th...

Juju allows arbitrary executable uploads via authenticated endpoint without authorization

Summary You can affect the agent binaries used in a Juju controller and the code that is run in the binaries by simply having a user account on a controller. You aren't required to have a model or any permissions. This just requires a user account in the controller database. Details Because of th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the charms HTTP API endpoint when handling uploaded ZIP files. An attacker can overwrite arbitrary files on the server by uploading a specially crafted ZIP archive containing directory traversal sequences,...

CVE-2025-0928

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or...

CVE-2025-0928 Arbitrary executable upload via authenticated endpoint

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or...

CVE-2025-53513

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through th...

CVE-2025-27127

A vulnerability has been identified in TIA Project-Server All versions V2.1.1, TIA Project-Server V17 All versions, Totally Integrated Automation Portal TIA Portal V17 All versions, Totally Integrated Automation Portal TIA Portal V18 All versions, Totally Integrated Automation Portal TIA Portal V...

PT-2025-28462 · Unknown · Code-Projects Staff Audit System

Name of the Vulnerable Software and Affected Versions: code-projects Staff Audit System version 1.0 Description: A critical issue was found in the code-projects Staff Audit System. The problem is related to an unknown function of the file /test.php, where the manipulation of the uploadedfile...

Code-Projects Staff Audit System 安全漏洞

Code-Projects Staff Audit System is an open source staff audit system from Code-Projects. A security vulnerability exists in Code-Projects Staff Audit System version 1.0, which stems from improper manipulation of the parameter uploadedfile in the file /test.php, which could lead to arbitrary file...

PT-2025-28503

Name of the Vulnerable Software and Affected Versions: Juju versions prior to 3.6.8 Juju versions prior to 2.9.52 Description: The issue allows any authenticated controller user to upload arbitrary agent binaries to any model or to the controller itself without verifying model membership or...

Code-Projects Library Management System 代码问题漏洞

Code-Projects Library Management System is an open source library management system from Code-Projects. A code issue vulnerability exists in Code-Projects Library Management System version 2.0, which stems from improper manipulation of the parameter photo in the file /admin/studenteditphoto.php,...

Expected Behavior Violation

Overview llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Expected Behavior Violation via the ArxivReader process. An attacker can cause data loss by uploading papers with identical titles but different contents, resulting in one paper...

rowboat 访问控制错误漏洞

rowboat is an AI-driven multi-intelligence builder open-sourced by RowBoat Labs. An access control error vulnerability exists in rowboat, which stems from missing authentication in the file apps/rowboat/app/api/uploads/fileId/route.ts...

Frauscher Sensortechnik多款产品 操作系统命令注入漏洞

Frauscher Sensortechnik FDS102 and others are a diagnostic system device from Frauscher. An operating system command injection vulnerability exists in various Frauscher Sensortechnik products, which stems from improper neutralization of special elements when uploading configuration files, and cou...

CampCodes Advanced Online Voting System 代码问题漏洞

CampCodes Advanced Online Voting System is an advanced online voting system from CampCodes, Inc. A code issue vulnerability exists in version 1.0 of the Campcodes Advanced Online Voting System, which stems from incorrect manipulation of the parameter photo in file /admin/votersadd.php, resulting ...

PT-2025-28253 · Arduino · Arduino-Esp32

Name of the Vulnerable Software and Affected Versions: arduino-esp32 versions prior to 3.2.1 Description: The issue affects several OTA update examples and the HTTPUpdateServer implementation in the arduino-esp32 core, allowing an attacker to upload and execute arbitrary firmware due to a lack of...