CVE-2025-54962

/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files such as .html or .svg, and these are then publicly accessible under the /static URI...

PT-2025-31796 · Unknown · Openplc Runtime

Name of the Vulnerable Software and Affected Versions: OpenPLC Runtime versions 3 through 9cd8f1b Description: An authenticated user can upload arbitrary files, such as .html or .svg, through the /edit-user endpoint in the webserver. These uploaded files are then publicly accessible under the...

PT-2025-31843 · Librettocms +1 · File Manager +1

Name of the Vulnerable Software and Affected Versions: LibrettoCMS versions prior to 1.1.7 Description: An unauthenticated arbitrary file upload vulnerability exists in the File Manager plugin. The upload handler located at /adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php does not proper...

PT-2025-31856 · Zkeacms · Zkeacms

Name of the Vulnerable Software and Affected Versions: ZKEACMS version 4.1 Description: An arbitrary file upload vulnerability exists in ZKEACMS version 4.1, allowing attackers to execute arbitrary code by uploading a crafted file. Recommendations: At the moment, there is no information about a...

CVE-2025-52239

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file...

CVE-2025-44139

Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=uploadzip...

CVE-2025-50848

A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious...

CVE-2014-125126

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header access=3 with HTTP requests. The application’s upload mechanism fails to restrict file types and does not...

CVE-2013-10034

An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and...

CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

CVE-2025-6076 CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

CVE-2025-6076 CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

PT-2025-31718 · Unknown · Partner Web Application +1

Name of the Vulnerable Software and Affected Versions: Partner Software application and Partner Web application versions 4.32 Partner Software application and Partner Web application affected versions not specified Description: The Partner Software application and Partner Web application do not...

CVE-2013-10055

An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 and possibly earlier in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a...

CVE-2013-10055 Havalite CMS Arbitary File Upload RCE

An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 and possibly earlier in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a...

CVE-2013-10055

CVE-2013-10055 affects Havalite CMS

CVE-2025-7443 BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the storejavascriptcache.php file in all versions up to, and including, 2.2.4...

WordPress plugin BerqWP 代码问题漏洞

WordPress BerqWP plugin is an automated performance optimization plugin for the WordPress platform, which is mainly used to improve website loading speed, Core Web Vitals score and search engine ranking. A file upload vulnerability exists in the WordPress BerqWP plugin, which stems from a missing...

PT-2025-31690 · Unknown · Lavalite Cms

Name of the Vulnerable Software and Affected Versions: Havalite CMS versions 1.1.7 and earlier Description: An unauthenticated arbitrary file upload issue exists in the upload.php script. The application does not properly validate file extensions or enforce authentication checks, allowing remote...

WordPress BerqWP plugin <= 2.2.42 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by mikemyers in WordPress Plugin BerqWP versions = 2.2.42...