CVE-2024-13908

The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2024-13908

CVE-2024-13908 pertains to the WordPress plugin SMTP by BestWebSoft, where arbitrary file uploads are possible due to missing file type validation in the save_options function across versions up to 1.1.9. The vulnerability requires authenticated Administrator+-level access to exploit and may enab...

WordPress plugin Product Input Fields for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2025-10421 · WordPress · The Aiomatic

Name of the Vulnerable Software and Affected Versions: The Aiomatic - Automatic AI Content Writer & Editor plugin for WordPress versions up to, and including, 2.3.8 Description: The issue is related to arbitrary file uploads due to missing file type validation in the aiomatic generate featured...

REDAXO 代码问题漏洞

REDAXO is a content management system from REDAXO open source. A code issue vulnerability exists in REDAXO versions prior to 5.18.3 that stems from allowing arbitrary file uploads...

CVE-2025-1307

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-1307

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-1307

CVE-2025-1307 affects the Newscrunch WordPress theme; versions up to 1.8.4.1 are vulnerable to an arbitrary file upload due to a missing capability check in newscrunch_install_and_activate_plugin(). Affected attackers: authenticated users with Subscriber+ privileges; impact includes potential rem...

CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...

WordPress plugin WooCommerce Ultimate Gift Card 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

VulnCheck KEV: CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

WordPress plugin Everest Forms 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2024-13869

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadfiles' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with...

SourceCodester Best Employee Management System 代码问题漏洞

SourceCodester Best Employee Management System is a SourceCodester open source employee management system. A code issue vulnerability exists in SourceCodester Best Employee Management System version 1.0, which stems from a lack of restrictions in the upload process, resulting in arbitrary file...

Education and Training System 代码问题漏洞

Education and Training System is an education and training system by the individual developer hzmanyun. A code issue exists in Education and Training System version 3.1.1, which stems from a lack of restrictions in the upload process, resulting in arbitrary file uploads...

CVE-2024-13365

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extracting .zip archives when scanning them for malware through the checkUploadedArchive function in all versions up to, and including, 2.149. This makes it possib...

CVE-2024-13714

The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'getimagebyurl' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with...

CVE-2024-56908

In Perfex Crm 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected uploadsalesfile endpoint. By providing malicious input in the relid parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directorie...

CVE-2024-13011

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...

CVE-2024-10960

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all versions up to, and including, 2.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to...