CVE-2025-15109

creationtimestamp| type| source ---|---|--- 2025-12-27 21:55:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115793756779838951 2025-12-27 22:27:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mayu4jubad2g...

CVE-2025-15109 jackq XCMS upload.php unrestricted upload

A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupload-2.1.2/examples/upload.php. This manipulation causes unrestricted upload. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-15109

CVE-2025-15109 concerns jackq XCMS up to build 3fab5342cc509945a7ce1b8ec39d19f701b89261, where the file Public/javascripts/admin/plupload-2.1.2/examples/upload.php contains a flaw that allows unrestricted file upload. The vulnerability can be triggered remotely and is supported by multiple source...

CVE-2017-15109

...

Out-of-bounds

A vulnerability has been identified in JT2Go All versions V13.2.0.5, Teamcenter Visualization All versions V13.2.0.5. The VCRUNTIME140.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted CGM files. An attacker could leverage this...

CVE-2021-44015

Siemens JT2Go and Teamcenter Visualization are affected. Vulnerability CVE-2021-44015 is an out-of-bounds read in CGM file parsing that can leak information via VCRUNTIME140.dll; root cause is improper validation while parsing specially crafted CGM files. Impact is information disclosure within t...

CVE-2020-15109

Summary: CVE-2020-15109 affects Solidus before 2.8.6, 2.9.6, and 2.10.2, enabling a malicious customer to change the current order’s address via crafted checkout data without updating shipment costs, impacting stores with at least two shipping zones and varying zone costs. Root cause: the checkou...

CVE-2019-15109

The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribepaged URL parameter...

CVE-2019-15109

The CVE-2019-15109 entry relates to WordPress plugin The Events Calendar (prior to version 4.8.2) and is caused by an XSS flaw in the tribe_paged URL parameter. Exploitation could enable client-side code execution. Affected software is the Events Calendar plugin for WordPress; vulnerable componen...