CVE-2025-29093

File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component...

CVE-2025-29093

Motivian Content Management System v.41.0.0 is affected by a File Upload vulnerability in the Content/Gallery/Images component. This flaw allows a remote attacker to execute arbitrary code by uploading malicious files. While the vulnerability is documented, there is no information regarding a new...

VulnCheck KEV: CVE-2025-3054

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

Cisco Identity Services Engine (cisco-sa-ise-file-upload-P4M8vwXY)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an...

CVE-2025-5523

A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site...

CVE-2025-5523 enilu web-flash File Upload upload fileService.upload cross site scripting

A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site...

CVE-2025-5523

CVE-2025-5523 affects enilu web-flash 1.0. The vulnerability resides in the fileService.upload function of FileController/upload (File Upload component). Manipulating the File argument leads to cross-site scripting, and exploitation can be performed remotely. The CVE description notes that the ex...

CVE-2025-48953

Umbraco is an ASP.NET content management system CMS. Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and...

CVE-2025-48953 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Umbraco is an ASP.NET content management system CMS. Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and...

CVE-2025-48953

Umbraco CMS (ASP.NET) has a file-upload bypass vulnerability: in versions 14.0.0 up to but not including 15.4.2 and 16.0.0, an API request can be manipulated to upload a file that doesn’t conform to the configured allowed extensions. The issue is fixed in 15.4.2 and 16.0.0. There are no publicly ...

Erupt Unrestricted Upload of File with Dangerous Type vulnerability

An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...

PT-2025-23631 · Jehc-Bpm · Jehc-Bpm

Name of the Vulnerable Software and Affected Versions: JEHC-BPM version 2.0.1 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file to the "/server/executeExec" API endpoint. This is due to an arbitrary file upload vulnerability in the component...

Document Uploading Vulnerability in Online Entrustment System of Zhuhai Xinhua Tong Software Co.

Zhuhai Xinhua Tong Software Co., Ltd. is a professional software company focusing on the research and development of informatization products and services in the industries of smart city and smart housing construction. A file upload vulnerability exists in the online entrustment system of Zhuhai...

CVE-2024-7074

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an...

CVE-2025-45997

Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can upload a PHP file disguised as an image by modifying the Content-Type header to image/jpg...

CVE-2025-48471

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of files uploaded to the application. This allows files to be uploaded with the phtml and phar extensions, which can lead to remote code executi...

CVE-2025-46080

HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server...

Exploit for CVE-2025-52078

PoC exploit for CVE-2025-52078, an unauthenticated arbitrary fil...

CVE-2025-46080

HuoCMS version 3.5.1 is vulnerable to an unrestricted file upload flaw in the AttachmentController.php file within the editFileUrl() method. The root cause is that the suffix of the $newPathUrl in the copy function is not validated against a whitelist, allowing an attacker to manipulate the suffi...

CVE-2025-46080

HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server...