CVE-2025-4561

CVE-2025-4561 affects KingFor KFOX. Multiple sources confirm an Arbitrary File Upload vulnerability that allows remote attackers with regular privileges to upload and execute web shell backdoors, resulting in arbitrary code execution on the server. Root cause identified as improper handling of fi...

CVE-2025-4561 Kinfor KFOX - Arbitrary File Upload

The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-4556

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-4556 ZONG YU Okcat Parking Management Platform - Arbitrary File Upload

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2025-20678 · Unknown · Okcat Parking Management Platform

Name of the Vulnerable Software and Affected Versions: Okcat Parking Management Platform affected versions not specified Description: The web management interface of the Okcat Parking Management Platform has an Arbitrary File Upload issue, allowing unauthenticated remote attackers to upload and...

CVE-2024-55466: Improper Neutralization of Special Elements used in a Command

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

KingFor KFOX code issue vulnerabilities

KingFor KFOX is a domestically owned and controlled industrial-grade real-time operating system from China's KingFor Information KingFor, targeting the intelligent manufacturing and Internet of Things IoT sectors. KingFor KFOX suffers from a code issue vulnerability that originates from allowing...

CVE-2025-4561: Unrestricted Upload of File with Dangerous Type

The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

WordPress TheGem Theme <= 5.10.3 is vulnerable to Arbitrary File Upload

Software TheGem Type Theme Vulnerable versions = 5.10.3 Fixed in 5.10.3.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-4317 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 9a2acfb1e3cd Credits Foxyyy Required privilege Subscriber Published...

CVE-2025-4556: Unrestricted Upload of File with Dangerous Type

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-55466

The ThingsBoard IoT platform (Community, Cloud, and Professional editions) is vulnerable to an arbitrary file upload vulnerability in the Image Gallery feature (version 3.8.1 and below ). While some descriptions suggest arbitrary code execution, detailed research reveals the root cause is Stored ...

ThingsBoard security vulnerabilities

ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard version v3.8.1, which stems from allowing the uploading of arbitrary files in Image Gallery, which could lead to the executi...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2025-46191

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

WordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Aiden Thái An in WordPress Plugin StoreKeeper for WooCommerce versions = 14.4.4...

WordPress Ajar in5 Embed plugin <= 3.1.5 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by LVT-tholv2k in WordPress Plugin Ajar in5 Embed versions = 3.1.5...

CVE-2025-46191

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

CVE-2025-4403 Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supportedtype string and the uploaded filename without enforcing real extension or MIME checks within th...