14754 matches found
PT-2025-6446 · WordPress · All-Images.Ai
Name of the Vulnerable Software and Affected Versions: All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to arbitrary file uploads due to missing file type validation in the get image by url function...
WordPress All-Images.ai plugin <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by mr6urnz in WordPress Plugin All-Images.ai versions = 1.0.4...
CVE-2025-26411
Wattsense Bridge devices are affected by CVE-2025-26411 through the web interface Plugin Manager. An authenticated attacker with a valid Wattsense web account can upload malicious Python files to the device, enabling remote root access. The vulnerability is tied to the Plugin Manager functionalit...
WordPress Zarinpal Paid Downloads plugin <= 2.3 - Admin+ Arbitrary File Upload vulnerability
Admin+ Arbitrary File Upload vulnerability discovered by Bob Matyas in WordPress Plugin Zarinpal Paid Download versions = 2.3...
CVE-2024-13544 Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload
The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...
CVE-2024-13544 Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload
The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...
CVE-2024-13011
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...
CVE-2024-13011 WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...
CVE-2024-57408
An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2024-57407
An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file...
WordPress WP Foodbakery plugin <= 4.7 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin FoodBakery versions = 4.7...
CVE-2024-57407
An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2024-57408
An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file...
PT-2025-6074 · Timo · Timo
Name of the Vulnerable Software and Affected Versions: Timo version 2.0.3 Description: An arbitrary file upload vulnerability in the component /userPicture allows attackers to execute arbitrary code via uploading a crafted file. Recommendations: For Timo version 2.0.3, consider disabling the...
CVE-2024-57408
CVE-2024-57408 affects cool-admin-java v1.0, with an arbitrary file upload vulnerability in the /comm/upload component that allows remote code execution through a crafted file. The Red Hat/PTSecurity and CN/CS reports confirm the issue and recommend disabling the /comm/upload endpoint and restric...
CVE-2024-57408
An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file...
PT-2025-6075 · Unknown · Cool-Admin-Java
Name of the Vulnerable Software and Affected Versions: cool-admin-java version 1.0 Description: An arbitrary file upload vulnerability in the component /comm/upload allows attackers to execute arbitrary code via uploading a crafted file. This issue enables attackers to upload malicious files,...
CVE-2024-57407
CVE-2024-57407 affects Timo v2.0.3, with a vulnerability in the /userPicture component allowing an attacker to upload a crafted file and potentially execute arbitrary code. Documented impact per CVSSv3.1: High (7.3), network attack vector, low attack complexity, privileges required: Low, user int...
