CVE-2023-25202

CVE-2023-25202: Insecure file upload mechanism Description CVE-2023-25202 involves an insecure file upload mechanism within the Therefore application, which is overly permissive in the types of files users can upload. The application only blocks uploads of HTML, EXE, and BAK files, leaving it...

CVE-2026-82865

pdfme schemas versions prior to 5.5.10 are affected by a cross-site scripting (XSS) vulnerability in the multiVariableText property panel . The root cause is the assignment of unsanitized i18n label values to innerHTML , allowing an attacker who controls label overrides via options.labels to inje...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion

The News & Blog Designer Pack WordPress plugin up to version 3.4.1 contains a remote code execution caused by local file inclusion in the bdpgetmorepost function, letting unauthenticated attackers include arbitrary PHP files, exploit requires AJAX request with crafted POST data. id: CVE-2023-5815...

WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read

WooCommerce Designer Pro theme for WordPress = 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication. id: CVE-2025-10897 info: nam...

CVE-2025-6440-Poc-Exploit

WC Designer Pro — 未认证的任意文件上传 安全研究概念验证 针对影响 WC Designer Pro WordPress 插件的未认证任意文件上传漏洞的非破坏性概念验证。 目录 漏洞概述 安全影响 受影响版本 根本原因 攻击流程 环境要求 安装 使用方法 技术细节 安全验证 暴露指标 修复措施 法律与道德使用 披露状态 参考资料 致谢 漏洞概述 WC Designer Pro 在通过 WordPress 的 admin-ajax.php 端点暴露的 AJAX 操作中存在一个未认证的任意文件上传漏洞。...

CVE-2025-10897

CVE-2025-10897 WooCommerce 是一个面向 WordPress 的开源电子商务插件，可将网站转变为在线商店。WooCommerce Designer Pro 是由 JMA Plugins 开发的 WordPress 插件，使客户能够直接在 WooCommerce 商店中设计和定制产品。 重要提示 ：WooCommerce 与 WooCommerce Designer Pro 是完全不同的产品。 WooCommerce Designer Pro 支持创建名片、明信片、传单、海报、T恤、贴纸及其他可打印材料，具备 CMYK 色彩支持、PDF...

WordPress-News-and-Blog-Designer-Bundle-CVE-2025-14502

Rapporto di analisi della vulnerabilità CVE-2025-14502 Riepilogo della vulnerabilità Tipo di vulnerabilità : Inclusione locale di file Local File Inclusion, LFI Versioni interessate : News and Blog Designer Bundle 1.1 e tutte le versioni precedenti Gravità : Alta Complessità dell'attacco : Bassa...

CVE-2025-6440

🧨 CVE-2025-6440 – WooCommerce Designer Pro Uneingeschränkter Datei-Upload Nicht authentifizierter Upload beliebiger Dateien überwcdpsavecanvasdesignajax WooCommerce Designer Pro-Plugin – Remote Code Execution RCE 📖 Beschreibung Das WooCommerce Designer Pro -Plugin für WordPress enthält eine...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Iniezione SQL non autenticata Descrizione Il plugin Fancy Product Designer per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 6.4.3 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Descrizione Il plugin WooCommerce Designer Pro per WordPress, ampiamente utilizzato specialmente in temi come Pricom - Printing Company & Design Services, è vulnerabile al caricamento arbitrario di file a causa della...

Disclosures

Offenlegungen Dieses Repository enthält meine Schwachstellenberichte, die weder unter eine NDA fallen noch durch die VRP-Nutzungsbedingungen eingeschränkt sind. Inhalt Fancy Product Designer Microsoft Xfinity...

Adobe Substance 3D Designer < 16.0.5 Multiple Vulnerabilities (APSB26-115)

The version of Adobe Substance 3D Designer installed on the remote host is prior to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-115 advisory. - Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in...

CVE-2026-71564

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48431

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48432

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48433

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48426

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48428

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48430

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...