CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

WordPress TheGem Theme <= 5.10.3 is vulnerable to Arbitrary File Upload

Software TheGem Type Theme Vulnerable versions = 5.10.3 Fixed in 5.10.3.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-4317 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 9a2acfb1e3cd Credits Foxyyy Required privilege Subscriber Published...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

ThingsBoard 安全漏洞

ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard version v3.8.1, which stems from allowing the uploading of arbitrary files in Image Gallery, which could lead to the executi...

CVE-2024-55466

CVE-2024-55466 affects ThingsBoard products (Community/Cloud/Professional) up to v3.8.1, where an arbitrary file upload in the Image Gallery can lead to arbitrary code execution. The root cause is an insecure file upload path in the Image Gallery component. In publicly available sources, guidance...

PT-2025-20678 · Unknown · Okcat Parking Management Platform

Name of the Vulnerable Software and Affected Versions: Okcat Parking Management Platform affected versions not specified Description: The web management interface of the Okcat Parking Management Platform has an Arbitrary File Upload issue, allowing unauthenticated remote attackers to upload and...

KingFor KFOX 代码问题漏洞

KingFor KFOX is a domestically owned and controlled industrial-grade real-time operating system from China's KingFor Information KingFor, targeting the intelligent manufacturing and Internet of Things IoT sectors. KingFor KFOX suffers from a code issue vulnerability that originates from allowing...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2025-46191

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

WordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Aiden Thái An in WordPress Plugin StoreKeeper for WooCommerce versions = 14.4.4...

WordPress Ajar in5 Embed plugin <= 3.1.5 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by LVT-tholv2k in WordPress Plugin Ajar in5 Embed versions = 3.1.5...

CVE-2025-46191

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

CVE-2025-4403 Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supportedtype string and the uploaded filename without enforcing real extension or MIME checks within th...

CVE-2025-4403

The CVE-2025-4403 entry concerns the WordPress plugin Drag and Drop Multiple File Upload for WooCommerce. Affected versions are all up to and including 1.1.6. The root cause is improper validation in the upload() function, where a user-supplied supported_type string and uploaded filename are acce...

CVE-2024-11617

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetralanguageUpload' and 'zetrafontsUpload' functions in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary fil...

CVE-2025-3455 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'startrestore' function in all versions up to, and including, 2.2. This makes it possible for authenticated...

CVE-2025-3455

CVE-2025-3455 affects the WordPress plugin “1 Click WordPress Migration Plugin – 100% FREE for a limited time” (versions up to 2.2). The root cause is a missing capability check in the start_restore function, enabling authenticated attackers with Subscriber+ privileges to upload arbitrary files t...

CVE-2025-3455 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'startrestore' function in all versions up to, and including, 2.2. This makes it possible for authenticated...

CVE-2024-11617

CVE-2024-11617 (Envolve Plugin – WordPress) affects the Envolve Plugin up to version 1.0. The issue is unauthenticated arbitrary file upload caused by missing file-type validation in the zetra_languageUpload and zetra_fontsUpload functions, which could allow an attacker to place arbitrary files o...

CVE-2024-11617 Envolve Plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetralanguageUpload' and 'zetrafontsUpload' functions in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary fil...