CVE-2025-4538: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

CVE-2025-4175: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability, which was classified as critical, was found in AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. This affects the function uploadUserProfileImage of the file...

CVE-2025-3558: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-3585: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3327

A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely...

CVE-2025-3327: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely...

PT-2025-13622 · Unknown · Bluestar Micro Mall

Name of the Vulnerable Software and Affected Versions: Bluestar Micro Mall version 1.0 Description: A critical vulnerability was found in Bluestar Micro Mall, affecting an unknown functionality of the file "/api/api.php?mod=upload&type=1". The manipulation of the File argument leads to unrestrict...

CVE-2025-2916: Improper Neutralization of Special Elements used in a Command

A vulnerability, which was classified as critical, has been found in Aishida Call Center System up to 20250314. This issue affects some unknown processing of the file /doscall/weixin/open/amr2mp3. The manipulation of the argument File leads to command injection. The attack may be initiated...

CVE-2025-2742: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack...

PT-2025-12451 · Unknown · Lzcms-Laozhangbokexitong

Name of the Vulnerable Software and Affected Versions: LzCMS-LaoZhangBoKeXiTong versions up to 1.1.4 Description: A critical issue affects some unknown functionality of the file /admin/upload/upimage.html, specifically the HTTP POST Request Handler component. The manipulation of the File argument...

CVE-2025-1834: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in zj1983 zz up to 2024-8. This affects an unknown part of the file /resolve. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the publ...

CVE-2025-1676

A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can be launched remotely. The exploit has...

CVE-2024-13141: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotel...

PT-2024-39538 · Unknown · Kalvingit Kvf-Admin

Name of the Vulnerable Software and Affected Versions: kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff Description: A critical issue has been found in the fileUpload function of the FileUploadKit.java file, allowing for unrestricted upload by manipulating the file argument. Thi...

CVE-2024-8865: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used...

PT-2024-39283

Name of the Vulnerable Software and Affected Versions: composiohq composio versions up to 0.5.8 Description: A vulnerability was found in composiohq composio, classified as problematic. The issue affects the function path of the file composioserverapi.py. The manipulation of the file argument lea...

PT-2024-37989 · Prain · Prain

Name of the Vulnerable Software and Affected Versions: Prain versions up to 1.3.0 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically affecting some unknown functionality of the file /?import. The manipulation of the file argument leads to code...

CVE-2024-6950: Improper Control of Generation of Code

A vulnerability, which was classified as critical, has been found in Prain up to 1.3.0. Affected by this issue is some unknown functionality of the file /?import of the component HTTP POST Request Handler. The manipulation of the argument file leads to code injection. The attack may be launched...

PT-2024-35943 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin up to 20240324 Description: A problematic vulnerability has been found in lakernote EasyAdmin, affecting an unknown part of the file /sys/file/upload. The manipulation of the file argument leads to cross-site scripting. It...

CVE-2024-5377: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in SourceCodester Vehicle Management System 1.0. It has been classified as critical. This affects an unknown part of the file /newvehicle.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit...