CVE-2025-0984 Arbitrary File Upload in Netoloji Software's E-Flow

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue...

mayi 代码问题漏洞

mayi is shuiyueju open source a performance management system . mayi 1.3.9 and previous versions of the code problem vulnerability , the vulnerability stems from the file app/tools/controller/File.php function Upload on the parameter File mishandling , may lead to arbitrary file upload...

CVE-2025-46730 Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications. Access to the MobSF web interface is often granted to internal security teams, audit teams, and external...

newbee-mall 代码问题漏洞

newbee-mall is a newbee open source e-commerce system. A code issue vulnerability exists in version 1.0 of newbee-mall, which stems from improper handling of the parameter File in the file ltd/newbee/mall/controller/common/UploadController.java, which could lead to arbitrary file uploads...

PT-2025-19707 · Outsystems · Outsystems

Name of the Vulnerable Software and Affected Versions: Outsystems versions prior to 3.1.0 Description: The issue arises because file extension and size validations are enforced solely on the client side in the Outsystems Multiple File Upload feature. This allows an attacker to intercept the uploa...

File Upload Vulnerability in Multi-service Intelligent Gateway of Resconda Technology Development Co.

Focusing on the field of fiber optic broadband access, Riseconda Technology Development Co., Ltd. is committed to the convergence of fiber optic technology, Ethernet technology and broadband access technology. A file upload vulnerability exists in the Multi-service Intelligent Gateway of Risconda...

PT-2025-19772

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.6 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Low-privileged users can upload HTML files containing JavaScript code via the "/api/v1/files/"...

CVE-2024-11390

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser XSS via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices...

CVE-2025-25016

Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation...

Exploit for Unrestricted Upload of File with Dangerous Type in Chamilo Chamilo_Lms

🛠️ Explotación CVE-2023-4226 para Chamilo LMS 📋 Descripció...

CVE-2024-11390

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser XSS via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices...

CVE-2025-25016 Kibana Unrestricted Upload of File

Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation...

PT-2025-18786 · Beaver Builder Team +2 · Beaver Builder Plugin +2

Name of the Vulnerable Software and Affected Versions: Beaver Builder Plugin Starter Version versions prior to 2.9.1 Description: The Beaver Builder Plugin Starter Version for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save enabled icons function...

CVE-2025-0049

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0...

CVE-2022-42449

Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

CVE-2025-31324-File-Upload A totally unauthenticated file-uplo...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

CVE-2025-31324 Burp Suite Extension Overview This Python-b...

CVE-2025-0520 ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

SAP-CVE-2025-31324 POC A tool to detect and exploit a critica...

Dust: Stored XSS in File Upload Leads to Privilege Escalation and Full Workspace Takeover

A stored cross-site scripting XSS vulnerability was discovered in the Dust platform's file upload functionality. An attacker could upload a malicious HTML file to a conversation. When another user, including an admin, visited the uploaded file, JavaScript was executed in their authenticated brows...