5530 matches found
CVE-2025-55835
File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering...
CVE-2025-10267
CVE-2025-10267 affects the NUP Portal by NewType Infortech. The issue is missing authentication, allowing unauthenticated remote attackers to upload files. If file extension restrictions are bypassed, attackers could upload a webshell and execute it on the server side. Modeled across multiple fee...
CVE-2025-55835
CVE-2025-55835 affects SueamCMS v0.1.2. A file upload vulnerability enables remote code execution due to insufficient input filtering. The CVE’s metrics indicate a NETWORK attack vector, low complexity, no privileges, and a CRITICAL impact (CVSS v3.1 base score 9.8). Exploitation status is not de...
CVE-2025-9112
The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccuretempfileuploader' function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to...
PT-2025-37005
Name of the Vulnerable Software and Affected Versions: Import any XML, CSV or Excel File to WordPress plugin versions through 3.9.3 Description: The Import any XML, CSV or Excel File to WordPress plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type...
Linux Distros Unpatched Vulnerability : CVE-2022-45592
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - hoteldruid - None Ubuntu Linux - 1 Server Side Request Forgery SSRF, 2 persistant Cross site scripting XSS, and 3 File upload vulnerability...
Vulnerabilities fixed in SAP products
SAP has fixed vulnerabilities in several products, including in SAP NetWeaver, SAP NetWeaver Application Server Java and SAP Landscape Transformation. The vulnerabilities are in the RMI-P4 module and the SAP NetWeaver AS Java platform, among others. The vulnerability with reference CVE-2025-42944...
Reliance on File Name or Extension of Externally-Supplied File
Overview mahocommerce/maho is a Free and open source ecommerce platform, created in 2024 on the M1 platform, PHP 8.3+ Affected versions of this package are vulnerable to Reliance on File Name or Extension of Externally-Supplied File via the file upload process. An attacker can execute arbitrary...
Mobile Shop Management System AddNewProduct.php file code problem vulnerability
Mobile Shop Management System is a store management system. Mobile Shop Management System has a code issue vulnerability that stems from the lack of valid validation of uploaded files in the parameter ProductImage in the file AddNewProduct.php. An attacker can exploit this vulnerability to upload...
Online Shopping Portal File Upload Vulnerability
Online Shopping Portal is an online store. A file upload vulnerability exists in Online Shopping Portal, which stems from a lack of extension validation in /admin/insert-product.php, and can be exploited by an attacker to cause arbitrary file uploads...
Mobile Shop Management System 代码问题漏洞
Mobile Shop Management System is a store management system. Mobile Shop Management System has a code issue vulnerability that stems from the lack of valid validation of uploaded files in the parameter ProductImage in the file AddNewProduct.php. An attacker can exploit this vulnerability to upload...
WordPress Mojoomla School Management plugin file upload vulnerability
WordPress Mojoomla School Management plugin is a WordPress plugin mainly used for school management system, support class management, student attendance, grade management, fee collection and other functions. WordPress Mojoomla School Management plugin has a file upload vulnerability, which stems...
HCL BigFix SM 安全漏洞
HCL BigFix SM is an AI-driven service management platform module from HCL India. A security vulnerability exists in HCL BigFix SM, which stems from a file upload validation bypass that could lead to the upload of malicious files...
Security Bulletin: Vulerability commons-fileupload affects IBM Integrated Analytics System
Summary The commons-fileupload package is used by IBM Integrated Analytics System as part of its file upload processing functionality. A denial-of-service DoS vulnerability was identified in Apache Commons FileUpload due to insufficient limits on multipart headers, which could allow a remote...
PT-2025-34700
Name of the Vulnerable Software and Affected Versions: WebErpMesv2 version 1.17 Description: A file upload vulnerability exists in the app/Http/Controllers/FactoryController.php controller. An authenticated attacker can upload arbitrary files, including PHP scripts. These files are accessible via...
CVE-2025-52130
File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...
CVE-2025-52130
CVE-2025-52130 is a file upload vulnerability in WebErpMesv2 prior to 1.19 (FactoryController.php in 1.17). An authenticated attacker can upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests and may lead to Remote Code Execution (RCE). Related advisories (R...
Security Bulletin: Vulnerability Malicious File Upload affects IBM Integrated Analytics System
Summary The file upload functionality in IIAS has been enhanced to enforce stricter validation across all supported file types. Extension check were implemented to ensure uploaded files match their expected format and content. This prevents the upload of malicious or improperly formatted files an...