PT-2025-53705

Name of the Vulnerable Software and Affected Versions BPMFlowWebkit affected versions not specified Description BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an arbitrary file upload issue. This allows unauthenticated remote attackers to upload and execute web shell backdoors, leading to...

CVE-2025-15228: Unrestricted Upload of File with Dangerous Type

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-15226: Unrestricted Upload of File with Dangerous Type

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons

Royal Elementor Addons ≤ 1.3.78 – Unauthenticated Arbitrary Fi...

WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Contentstudio versions = 1.3.7...

WordPress GravityForms plugin < 2.9.23.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Marc Montpas in WordPress Plugin Gravity Forms versions 2.9.23.1...

CVE-2025-2155

CVE-2025-2155 affects Specto CM (Echo Call Center Services Trade and Industry Inc.). The vulnerability is an Unrestricted Upload of File with Dangerous Type, enabling Remote Code Inclusion. Affected versions are before 17032025. Root cause: improper file‑type validation allowing executable conten...

CVE-2025-2155 Arbitrary File Upload in EchoCCS's Specto CM

Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025...

WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter in WordPress Plugin MapSVG versions = 8.7.3...

CVE-2025-13407

The Gravity Forms WordPress plugin (versions before 2.9.23.1 ) is vulnerable to an unauthenticated arbitrary file upload via its chunked upload functionality. The gf_page=upload endpoint fails to perform proper server-side file type validation or authentication checks, allowing attackers to uploa...

CVE-2025-13407 GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload...

CVE-2025-13407 GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload...

WordPress File Uploader for WooCommerce plugin <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data vulnerability

Unauthenticated Arbitrary File Upload via add-image-data vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin File Uploader for WooCommerce versions = 1.0.3...

CVE-2025-51511

Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...

EUVD-2025-204847

Cadmium CMS has a background arbitrary file upload vulnerability...

GHSA-QX44-P258-3C2V Cadmium CMS has a background arbitrary file upload vulnerability

Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...

CVE-2025-51511

Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...

CVE-2025-67288

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation as shown in the documentation belongs to the system administrator who is...

CVE-2025-67289

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file...

PT-2025-52846

Name of the Vulnerable Software and Affected Versions Cadmium CMS version 0.4.9 Description Cadmium CMS version 0.4.9 has a background arbitrary file upload issue in the /admin/content/filemanager/uploads endpoint. The vulnerability allows for unauthorized file uploads. The uploads directory is t...