5510 matches found
CVE-2025-26325
ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php...
ShopXO 代码问题漏洞
ShopXO is an open source enterprise-grade open source e-commerce system from ShopXO Inc. A security vulnerability exists in ShopXO version 6.4.0, which stems from the existence of file uploads in ThemeDataService.php...
CVE-2025-26325
ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php...
CVE-2025-26325
ShopXO 6.4.0 is vulnerable to Arbitrary File Upload via ThemeDataService.php. CVE-2025-26325 enables file upload without proper validation, with a reported CVSS v3.1 base score of 9.8 (CRITICAL). Several sources (SNYK, Red Hat, OSV, NVD) describe the issue; no fixed version is listed. Remediation...
GHSA-4W2W-36VM-C8HF Mautic allows Relative Path Traversal in assets file upload
Summary This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to...
Mautic allows Relative Path Traversal in assets file upload
Summary This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to...
CVE-2025-25790
An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file...
CVE-2025-25783
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...
CVE-2025-0731
An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user...
CVE-2022-25773 Relative Path Traversal in assets file upload
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to...
CVE-2025-0731 SMA: Sunny Portal Remote Code Execution
An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user...
CVE-2025-25783
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...
Mautic 安全漏洞
Mautic is an open source marketing automation application. An arbitrary file upload vulnerability exists in Mautic versions prior to 5.2.3, which stems from insufficient validation of uploaded file extensions and improper handling of file paths. An attacker can exploit this vulnerability to uploa...
CVE-2025-25790
An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file...
CVE-2024-46226
CVE-2024-46226 describes a stored XSS in HelpDeskZ
CVE-2025-25783
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...
CVE-2025-27142 LocalSend path traversal vulnerability in the file upload endpoint allows nearby devices to execute arbitrary commands
LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the POST /api/localsend/v2/prepare-upload and th...
100,000 WordPress Sites Affected by Arbitrary File Upload, Read and Deletion Vulnerability in Everest Forms WordPress Plugin
📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...
CVE-2025-1598
CVE-2025-1598 affects SourceCodester Best Church Management Software 1.0. A vulnerability exists in the /admin/app/asset_crud.php endpoint where manipulation of the photo1 parameter allows unrestricted file upload, enabling remote exploitation. Multiple sources confirm an arbitrary/unrestricted u...