CVE-2025-47939 TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer

TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restrictio...

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jingle Bells in WordPress Plugin Hospital Management System versions = 47.020-11-2023...

CVE-2025-39401

Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through = 44.0 17-08-2023...

CVE-2025-39380 WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Server.This issue affects Hospital Management System: from n/a through = 47.020-11-2023...

CVE-2025-39380

CVE-2025-39380 corresponds to an Arbitrary/Unrestricted File Upload vulnerability in the WordPress plugin for Mojoomla Hospital Management System (Hospital Management System). Affected: mojoomla Hospital Management System WordPress plugin versions prior to 47.0 (up to 2023-11-20). Impact cited ac...

CVE-2025-47577

Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through = 2.9.2...

CVE-2025-26892

Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2...

CVE-2025-47577 WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through = 2.9.2...

CVE-2025-26872 WordPress Eximius theme <= 2.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2...

CVE-2025-4190

The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

PT-2025-22102 · Mojoomla · Mojoomla Hospital Management System

Name of the Vulnerable Software and Affected Versions: mojoomla Hospital Management System versions prior to 47.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further...

SourceCodester Client Database Management System 代码问题漏洞

SourceCodester Client Database Management System is SourceCodester open source a client database management system . A code issue vulnerability exists in SourceCodester Client Database Management System version 1.0, which originates from an unlimited upload due to the operation of the parameter...

PT-2025-22108 · Mojoomla · Wpams

Name of the Vulnerable Software and Affected Versions: mojoomla WPAMS versions prior to 44.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and potential...

PT-2025-21839 · Unknown · Merikbest Ecommerce-Spring-Reactjs

Name of the Vulnerable Software and Affected Versions: merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd Description: A critical issue affects some unknown functionality of the file "/api/v1/admin/" of the component File Upload Endpoint. The manipulation of the...

CVE-2025-47787

Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation...

CVE-2025-4389

The CVE-2025-4389 entry concerns the WordPress plugin Crawlomatic Multipage Scraper Post Generator. A missing file type validation in the function crawlomatic_generate_featured_image() allows unauthenticated arbitrary file uploads in all versions up to 2.6.8.1, potentially enabling remote code ex...

PT-2025-21780 · WordPress · Csv Mass Importer

Name of the Vulnerable Software and Affected Versions: CSV Mass Importer WordPress plugin versions 1.2 and earlier Description: The issue concerns the CSV Mass Importer WordPress plugin, which does not properly validate uploaded files. This allows high-privilege users, such as administrators, to...

PT-2025-21776

Name of the Vulnerable Software and Affected Versions: Crawlomatic Multipage Scraper Post Generator plugin for WordPress versions up to, and including, 2.6.8.1 Description: The issue is related to arbitrary file uploads due to missing file type validation in the crawlomatic generate featured imag...

Bypass group folder quota limit using attachment in text file

None...

File Upload Vulnerability in MetaCRM of Beijing Meta Software Technology Co.

MetaCRM6 is a customer relationship management system. A file upload vulnerability exists in MetaCRM, which can be exploited by attackers to upload malicious files and gain server privileges...