CVE-2025-2249

The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sojsoundslidesoptionssubpanel function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and...

WordPress Real Estate 7 Theme <= 3.5.4 is vulnerable to Arbitrary File Upload

Software Real Estate 7 Type Theme Vulnerable versions = 3.5.4 Fixed in 3.5.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-2891 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 22e03f3e7c10 Credits Foxyyy Required privilege Seller...

VulnCheck KEV: CVE-2025-26319

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...

Exploit for Out-of-bounds Write in Gibbonedu Gibbon

CVE-2023-45878 GibbonEdu Arbitrary File Write to Web Shell...

CVE-2025-2249 SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sojsoundslidesoptionssubpanel function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-2006 Inline Image Upload for BBPress <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload

The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-2006 Inline Image Upload for BBPress <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload

The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level...

Exploit for CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This ex...

WordPress SoJ Soundslides plugin <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by Hoang Phuc Vo HrxKnight in WordPress Plugin SoJ SoundSlides versions = 1.2.2...

WordPress Inline Image Upload for BBPress plugin <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by yudha in WordPress Plugin Inline Image Upload for BBPress versions = 1.1.19...

MoziloCMS 3.0 - Remote Code Execution (RCE)

Exploit Title: MoziloCMS 3.0 - Remote Code Execution RCE Date: 10/09/2024 Exploit Author: Secfortress https://github.com/sec-fortress Vendor Homepage: https://mozilo.de/ Software Link: https://github.com/moziloDasEinsteigerCMS/mozilo3.0/archive/refs/tags/3.0.1.zip Version: 3.0 Tested on: Debian...

CVE-2025-2749

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code...

Exploit for CVE-2024-31114

CVE-2024-31114 - WordPress Shortcode Addons RCE Exploit Sho...

HPESBNW04834 rev.1 - HPE Unified OSS Console (UOC) and HPE Unified OSS Assurance Monitoring (UOCAM) Software, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information, Arbitrary file upload; Remote: Denial of Service DoS, Disclosure of Information, Arbitrary file upload, Unquoted Search Path SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console...

CVE-2025-2749

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code...

Exploit for Unrestricted Upload of File with Dangerous Type in Webfulcreations Computer_Repair_Shop

🛡️ WordPress RepairBuddy Plugin Exploit 📜 CVE Information...

PT-2025-12671

Name of the Vulnerable Software and Affected Versions Kentico Xperience versions prior to 13.0.179 Description An authenticated remote code execution issue allows authenticated users of the Staging Sync Server to upload arbitrary data to path relative locations. This leads to path traversal and...

Exploit for CVE-2024-49653

📜 WordPress Portfolleo Plugin Exploit CVE-2024-49653 🚨 V...

CVE-2024-10902

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability...

CVE-2024-8060

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...