235 matches found
CVE-2026-22241 Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)
The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system...
CVE-2025-67924
CVE-2025-67924 is a WordPress theme vulnerability affecting Corpkit (Corpkit – Business Consulting WordPress Theme)
Priority Web 代码问题漏洞
Priority Web is the Web side of an enterprise resource planning system from Priority Israel. A code issue vulnerability exists in Priority Web that stems from an unrestricted upload of a dangerous type of file, which could lead to an arbitrary file upload attack...
CVE-2025-2155 Arbitrary File Upload in EchoCCS's Specto CM
Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025...
CVE-2023-53942 File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with ...
CVE-2025-64231
The CVE-2025-64231 entry concerns the WordPress plugin RTW WordPress Contact Form 7 PDF, Google Sheet & Database (rtwwcfp-wordpress-contact-form-7-pdf) versions up to 3.0.0. The vulnerability is an Unrestricted Upload of File with Dangerous Type, allowing upload of malicious files via the plugin’...
CVE-2025-34437 AVideo < 20.1 IDOR Arbitrary Comment Image Upload
AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects...
Arbitrary File Upload
Overview soosyze/soosyze is a Soosyze CMS is a minimalist content management system in PHP, without database to create and manage your website easily. Affected versions of this package are vulnerable to Arbitrary File Upload via the upload endpoint. An attacker can execute arbitrary PHP code and...
PT-2025-49357
Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery versions 4.5.4 through 4.5.7 Description The All-in-One Video Gallery plugin for WordPress has a flaw that allows unauthorized file uploads. This is due to a lack of proper file type checking within the resolve import...
CVE-2025-12154 Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload
The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload...
CVE-2025-63994
CVE-2025-63994 affects RichFilemanager v2.7.6. The vulnerability is in the /php/UploadHandler.php component and allows an attacker to upload a crafted file, enabling arbitrary code execution. Reported base metrics indicate a critical CVSS v3.1 score (9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Red...
CVE-2025-63678
An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...
CVE-2025-6327
The CVE-2025-6327 entry concerns the WordPress plugin King Addons for Elementor, versioned up to 51.1.36, which suffers an Unrestricted Upload of File with Dangerous Type vulnerability in king-addons. The flaw allows uploading a web shell to the web server via the plugin (arbitrary file upload vu...
CVE-2025-62016 WordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through = 4.22.0...
CVE-2025-10896
CVE-2025-10896 affects multiple WordPress plugins in the Jewel Theme Recommended Plugins Library. The vulnerability is Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation due to missing capability checks in the *_recommended_upgrade_plugin function, enabling authenti...
CVE-2025-11675
CVE-2025-11675 affects Ragic’s Enterprise Cloud Database. The connected sources describe an Arbitrary File Upload vulnerability that lets privileged remote attackers upload and execute web shell backdoors, enabling arbitrary code execution on the server. The reports consistently name the affected...
CVE-2025-11660
A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some unknown functionality of the file /assets/uploadSllyabus.php. Such manipulation of the argument File leads to unrestricted upload. The atta...
Get Projects School Management System 代码问题漏洞
Get Projects School Management System is a Get Projects open source school management system software. A code issue vulnerability exists in Get Projects School Management System, which stems from a misbehavior of the parameter File in the file /assets/uploadSllyabus.php, which could lead to...
CVE-2025-9212
The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpdispatcherprocessupload function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
