5553 matches found
CVE-2025-50688
A command injection vulnerability exists in TwistedWeb version 14.0.0 due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file e.g., a reverse shell script. Once...
CVE-2025-6207
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
CVE-2025-50688
A command injection vulnerability exists in TwistedWeb version 14.0.0 due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file e.g., a reverse shell script. Once...
CVE-2025-52078
File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted POST request to the /file-upload endpoint...
PT-2025-31990 · Unknown · Kordil Edms
Name of the Vulnerable Software and Affected Versions: Kordil EDMS version 2.2.60rc3 Description: An unauthenticated arbitrary file upload vulnerability exists in the application. The application exposes an upload endpoint /users add.php that allows attackers to upload files to the /userpictures/...
PT-2025-31978 · WordPress · Asset-Manager
Name of the Vulnerable Software and Affected Versions: Asset-Manager for Wordpress versions 2.0 and earlier Description: The Wordpress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint does not properly validate...
WordPress plugin WP-Property 安全漏洞
WordPress WP-Property plugin is a real estate industry-specific plugin for the WordPress platform, which is mainly used to help users manage property listings, display listing information and attract potential customers. A file upload vulnerability exists in the WordPress WP-Property plugin, whic...
CVE-2025-52078
The Writebot AI Content Generator SaaS React Template (versions 4.0.0 and below ) is vulnerable to an unauthenticated arbitrary file upload (CWE-434). A remote attacker can exploit this flaw by sending a crafted POST request to the /file-upload (or potentially /upload) endpoint to upload maliciou...
CVE-2025-52078
File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted POST request to the /file-upload endpoint...
PT-2025-31912 · WordPress · Wp Import Export Lite
Name of the Vulnerable Software and Affected Versions: WP Import Export Lite plugin for WordPress versions up to and including 3.9.29 Description: The WP Import Export Lite plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the wpie pars...
CVE-2025-50688
A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality . An attacker can send a specially crafted HTTP PUT request to upload a malicious file, such as a reverse shell script, and subsequently trigger its executio...
CVE-2013-10047
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server = Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the upload handler and crafting a traversal path, an attacker can place a malicious .exe in system32,...
PT-2025-31796 · Unknown · Openplc Runtime
Name of the Vulnerable Software and Affected Versions: OpenPLC Runtime versions 3 through 9cd8f1b Description: An authenticated user can upload arbitrary files, such as .html or .svg, through the /edit-user endpoint in the webserver. These uploaded files are then publicly accessible under the...
PT-2025-31843 · Librettocms +1 · File Manager +1
Name of the Vulnerable Software and Affected Versions: LibrettoCMS versions prior to 1.1.7 Description: An unauthenticated arbitrary file upload vulnerability exists in the File Manager plugin. The upload handler located at /adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php does not proper...
CVE-2025-52239
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file...
WordPress Shopo Theme <= 1.1.4 is vulnerable to Arbitrary File Upload
Software Shopo Type Theme Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-31048 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 148bf5acafb9 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...
PT-2025-31856 · Zkeacms · Zkeacms
Name of the Vulnerable Software and Affected Versions: ZKEACMS version 4.1 Description: An arbitrary file upload vulnerability exists in ZKEACMS version 4.1, allowing attackers to execute arbitrary code by uploading a crafted file. Recommendations: At the moment, there is no information about a...
CVE-2025-54962
/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files such as .html or .svg, and these are then publicly accessible under the /static URI...
CVE-2025-54962
/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files such as .html or .svg, and these are then publicly accessible under the /static URI...