CVE-2025-8323 Ventem｜e-School - Arbitrary File Upload

The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-8323: Unrestricted Upload of File with Dangerous Type

The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2025-31375 · Ventem · E-School

Name of the Vulnerable Software and Affected Versions: e-School from Ventem affected versions not specified Description: The e-School from Ventem has an Arbitrary File Upload vulnerability. This allows unauthenticated remote attackers to upload and execute web shell backdoors, enabling arbitrary...

Ventem e-School code-related vulnerabilities

Ventem e-School is a smart school platform from Feiyu Hi-Tech Ventem of Taiwan, China. A code issue vulnerability exists in Ventem e-School, which originates from the arbitrary file upload feature and could lead to remote code execution...

Attackers Actively Exploiting Critical Vulnerability in Alone Theme

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters!📢 🌞 Spring into Summer with Wordfence! Now through August 4, 2025, earn 2X bounty rewards forall in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per...

WordPress Atarim plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Plugin Atarim versions = 4.2.1...

Code-Projects Online Ordering System code-related vulnerabilities

Online Ordering System is an online ordering system. A file upload vulnerability exists in Online Ordering System, which stems from the image parameter in the /admin/product.php file not effectively limiting file uploads. No details of the vulnerability are available at this time...

Samsung MagicINFO 9 Server OpenApiController Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung MagicINFO 9 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpenApiController class. The issue results from the lack of proper...

Samsung MagicINFO 9 Server filenameHasExecutableType Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung MagicINFO 9 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the filenameHasExecutableType method. The issue results...

CVE-2025-5831

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the makegooglefontoffline function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

Arbitrary File Upload

Overview hybridauth/hybridauth is a PHP Social Authentication Library Affected versions of this package are vulnerable to Arbitrary File Upload via install.php, which remains accessible post-installation. An attacker can execute arbitrary PHP code on the server by injecting malicious input into t...

CVE-2013-10032

CVE-2013-10032 affects GetSimpleCMS 3.2.1 via upload.php, where authenticated users can upload arbitrary files without proper MIME/extension validation, allowing a disguised .pht containing PHP code to be placed in the web root and executed. Root cause: blacklist-based filtering instead of a whit...

CVE-2013-10032 GetSimple CMS 3.2.1 Authenticated RCE via Arbitrary PHP File Upload

An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to upload arbitrary files without proper validation of MIME types or extensions. By uploading a .pht file containing PHP code, an attacker ca...

CVE-2025-5831

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the makegooglefontoffline function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

CVE-2025-5831

CVE-2025-5831 affects the Droip WordPress plugin. The vulnerability arises from missing file type validation in the make_google_font_offline() function, allowing authenticated users with Subscriber+ privileges to upload arbitrary files to the server (versions up to 2.2.0). This can potentially le...

CVE-2025-5831 Droip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File Upload

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the makegooglefontoffline function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

CVE-2025-5831 Droip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File Upload

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the makegooglefontoffline function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

CVE-2015-10144

The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary...

CVE-2015-10144 Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary...

CVE-2015-10144

CVE-2015-10144 affects the WordPress plugin Responsive Thumbnail Slider prior to 1.0.1. The root cause is inadequate validation/sanitization in the image uploader, allowing authenticated attackers (subscriber level or higher) to upload arbitrary files via a double extension, with potential remote...