5553 matches found
CVE-2025-34111
CVE-2025-34111 affects Tiki Wiki CMS Groupware
CVE-2025-34111 Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector connector.minimal.php, which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The...
CVE-2025-34111 Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector connector.minimal.php, which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The...
CVE-2025-7340
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the tempfileupload function in all versions up to, and including, 2.2.1. This makes it possible for...
CVE-2025-53891 TIME LINE has Improper File Validation in Upload Section
The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE website where uploaded files instruction/message media are not strictly validated for type and size. A user may upload renamed or oversized files that can...
PT-2025-29553 · Unknown +1 · Tikiwiki Cms/Groupware +1
Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS Groupware versions 15.1 and earlier Description: An unauthenticated arbitrary file upload issue exists in the Tiki Wiki CMS Groupware software. The vulnerability is located within the ELFinder component’s default connector...
PT-2025-29532
Name of the Vulnerable Software and Affected Versions HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. versions up to and including 2.2.1 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress i...
CVE-2025-51650
An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a crafted template file...
PT-2025-29391 · Unknown · Campcodes Online Movie Theater Seat Reservation System
Name of the Vulnerable Software and Affected Versions: Campcodes Online Movie Theater Seat Reservation System version 1.0 Description: A critical issue exists in Campcodes Online Movie Theater Seat Reservation System version 1.0. The save movie function within the /admin/admin class.php file is...
CVE-2025-6423
The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handlesubmituploadfile function in all versions up to, and including, 2.3.5. This makes it possible for authenticated attackers with Subscriber-level access or higher ...
CVE-2025-6058
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle function hooked via the 'addbookingtype' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitra...
PT-2025-29293 · WordPress · Wpbookit
Name of the Vulnerable Software and Affected Versions: WPBookit versions up to and including 1.0.4 Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle image upload function. This allows authenticated attackers wi...
PT-2025-29310 · WordPress · Beeteam368 Extensions
Name of the Vulnerable Software and Affected Versions: BeeTeam368 Extensions plugin for WordPress versions up to and including 2.3.5 Description: The BeeTeam368 Extensions plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation within the handle...
CVE-2025-34085
An unrestricted file upload vulnerability in the WordPress Simple File List plugin prior to version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint ee-upload-engine.php restricts file uploads based on extension, but lacks proper...
CVE-2024-39752 IBM Analytics Content Hub file upload
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could be vulnerable to malicious file upload by not validating the type of file uploaded to Explore Content. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing...
CVE-2024-39752 IBM Analytics Content Hub file upload
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could be vulnerable to malicious file upload by not validating the type of file uploaded to Explore Content. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing...
CVE-2024-39752
IBM Analytics Content Hub 2.0–2.3 includes a vulnerability where uploaded files are not validated by type in Explore Content, enabling potential malicious executable uploads. The issue is documented with a high-severity CVSS indicating impact on confidentiality, integrity, and availability. Remed...
Advanced Online Voting System
Campcodes Complete Sales and Inventory System V1.0 /pages/prod...
BIT-TOMCAT-2025-24813 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.2, from 10.1.0 through 10.1.34,...