CVE-2025-66256

Unauthenticated Arbitrary File Upload patchcontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patchcontents.php allows uploading malicious files...

CVE-2025-66250

Unauthenticated Arbitrary File Upload statuscontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/statuscontents.php...

CVE-2025-66256 Unauthenticated Arbitrary File Upload (patch_contents.php)

Unauthenticated Arbitrary File Upload patchcontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patchcontents.php allows uploading malicious files...

CVE-2025-66255 Unauthenticated Arbitrary File Upload (upgrade_contents.php)

Unauthenticated Arbitrary File Upload upgradecontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. Th...

EUVD-2025-199682

Unauthenticated Arbitrary File Upload statuscontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/statuscontents.php...

CVE-2025-66250 Unauthenticated Arbitrary File Upload (status_contents.php)

Unauthenticated Arbitrary File Upload statuscontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/statuscontents.php...

CVE-2025-66250

CVE-2025-66250 affects DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter firmware (models 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000). The vulnerability is an unauthenticated arbitrary file upload via the /var/tdf/status_contents.php endpoint in the status_contents.php ...

CVE-2025-13595

The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.10.8. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

CVE-2025-13597 AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload

The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

CVE-2025-13597 AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload

The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

CVE-2025-13595 CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload

The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.10.8. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

CVE-2025-13595

CIBELES AI WordPress plugin vulnerability (CVE-2025-13595) arises from a missing capability check in actualizador_git.php, affecting all versions up to 1.10.8. Unauthenticated attackers can perform arbitrary file uploads, enabling retrieval of GitHub repos and overwriting plugin files on the serv...

CVE-2025-13595 CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload

The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.10.8. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

CVE-2025-13376

The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's...

WordPress ProjectList plugin <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload vulnerability

Authenticated Editor+ Arbitrary File Upload vulnerability discovered by Ivan Cese in WordPress Plugin ProjectList versions = 0.3.0...

CVE-2025-13376 ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload

The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's...

CVE-2025-13376 ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload

The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's...

CVE-2025-13376

The CVE-2025-13376 entry concerns the WordPress ProjectList plugin with versions up to 0.3.0, where missing file-type validation allows authenticated users with Editor-level access or higher to upload arbitrary files to the server. This vulnerability potentially enables remote code execution. Pub...

WordPress WavePlayer plugin <= 3.7.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by @zdenys in WordPress Plugin WavePlayer versions = 3.7.0...

WordPress plugin AI Feeds 代码问题漏洞

WordPress AI Feeds plugin is an open source software that is mainly used to generate and manage feeds for blogs. WordPress AI Feeds plugin suffers from an arbitrary file upload vulnerability that stems from the application's lack of effective validation of uploaded files. The vulnerability can be...