CVE-2025-55383

Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files of any extension to any location on the target server...

CVE-2025-55383

Versions of Moss prior to v0.15 are vulnerable to an Arbitrary File Upload vulnerability. The issue stems from a misconfiguration in the upload function , which allows an attacker to upload files with any extension to any location on the target server. Remediation involves updating Moss to versio...

Oracle Linux 9 : tomcat (ELSA-2025-14181)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14181 advisory. - Resolves: RHEL-102200 tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames CVE-2025-48989 - Resolves: RHEL-108491 tomcat: Apache...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2025-43750

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows remote unauthenticated users guests to upload files via th...

tomcat security update

1:9.0.87-1.el810.6 - Resolves: RHEL-102193 tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames CVE-2025-48989 1:9.0.87-1.el810.5 - Resolves: RHEL-108486 tomcat: Apache Commons FileUpload DOS via part headers CVE-2025-48976 - Resolves: RHEL-108494 tomcat: Dos in multipart upload...

WordPress plugin Bit Form builder code problem vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A file upload vulnerability exists in WordPress plugin Bit Form builder 2.20.4 and earlier versions, whi...

Oracle Linux 8 : tomcat (ELSA-2025-14177)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14177 advisory. - Resolves: RHEL-102193 tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames CVE-2025-48989 - Resolves: RHEL-108486 tomcat: Apache...

MoonShine Arbitrary File Upload Vulnerability

An arbitrary file upload vulnerability in MoonShine v3.12.4 allows attackers to execute arbitrary code via uploading a crafted SVG file...

PT-2025-33846 · Itsourcecode · Itsourcecode Online Tour/Travel Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Tour and Travel Management System version 1.0 Description: A vulnerability exists in itsourcecode Online Tour and Travel Management System that allows for unrestricted file upload. The issue affects unknown code within the...

CVE-2025-8464

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7guestuserid cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the...

WordPress plugin Bit Form builder 代码问题漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A file upload vulnerability exists in WordPress plugin Bit Form builder 2.20.4 and earlier versions, whi...

CVE-2025-43736

A Denial Of Service via File Upload DOS vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92...

CVE-2025-43736

A Denial Of Service via File Upload DOS vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92...

WordPress WP-Property plugin file upload vulnerability

WordPress WP-Property plugin is a real estate industry-specific plugin for the WordPress platform, which is mainly used to help users manage property listings, display listing information and attract potential customers. A file upload vulnerability exists in the WordPress WP-Property plugin, whic...

PT-2025-32548 · Unknown · Eblog Site

Name of the Vulnerable Software and Affected Versions: eBlog Site version 1.0 Description: A vulnerability exists in the File Upload Module of eBlog Site 1.0, specifically within the /native/admin/save-slider.php file. This allows for unrestricted file uploads, and the attack can be launched...

Linux Distros Unpatched Vulnerability : CVE-2015-6660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that...

CVE-2012-10045

XODA 0.4.5 contains an unauthenticated file upload vulnerability in the upload functionality. An attacker can upload a PHP file to the web-accessible files/ directory and trigger execution via a subsequent GET request, leading to remote code execution. Remediation/patch status not provided in the...

CVE-2012-10026

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary...

CVE-2013-10067

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gwadmin.php allows users with administrator privileges to upload files to the gwtemp/a/ directory. Due to insufficient...