CVE-2025-13827

Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is not restricted from running files this can lead to a remote code execution...

CVE-2025-13827

The CVE-2025-13827 entry concerns GrapesJS Builder in Mautic, where file upload is not restricted by type, allowing arbitrary files to be uploaded. The underlying issue is that the media folder may execute uploaded files, potentially enabling remote code execution (RCE). Affected components are t...

Exploit for CVE-2025-1337

CVE‑2025‑1337 — Intentional Remote Code Execution Training Mac...

CVE-2025-13871

Cross-Site Request Forgery CSRF in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication...

CVE-2025-13871

Cross-Site Request Forgery CSRF in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication...

EUVD-2025-200217

Cross-Site Request Forgery CSRF in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication...

CVE-2025-13871 The feature to manage resources is prone to Cross-Site Request Forgery attacks

Cross-Site Request Forgery CSRF in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication...

CVE-2025-13871

CVE-2025-13871 concerns CSRF in the Resource-Management feature of ObjectPlanet Opinio 7.26 rev12562. The vulnerability allows uploading files on behalf of authenticated users and subsequently accessing those files without authentication. Concrete details across connected sources confirm the affe...

CVE-2025-13516 SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload

The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's savefile function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessibl...

CVE-2025-13516

The SureMail – SMTP and Email Logs Plugin for WordPress is affected by an Unauthenticated Arbitrary File Upload in versions

Directory Traversal

Overview flamehaven-filesearch is a FLAMEHAVEN FileSearch - Open source semantic document search with API authentication powered by Google Gemini Affected versions of this package are vulnerable to Directory Traversal due to insufficient validation and sanitization of user-controlled filenames in...

PT-2025-48658

Name of the Vulnerable Software and Affected Versions ObjectPlanet Opinio version 7.26 rev12562 Description A Cross-Site Request Forgery CSRF issue exists in the resource-management feature. This allows an attacker to upload files on behalf of connected users and then access those files without...

FeehiCMS 安全漏洞

FeehiCMS is a Php-based CMS website builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.1.1, which stems from an insufficient file upload limit in the advertisement management, and may lead to remote code execution...

PT-2025-48723

Name of the Vulnerable Software and Affected Versions GrapesJS affected versions not specified Description The GrapesJS Builder allows the upload of arbitrary files due to a lack of file type restrictions. If the media folder is not configured to prevent file execution, this could lead to remote...

CVE-2025-65657

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes or stores in an executable location without sufficient validation, sanitization, or executi...

CVE-2025-65657

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes or stores in an executable location without sufficient validation, sanitization, or executi...

CVE-2025-51736

File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0...

Arbitrary Code Execution

melisplatform/melis-cms-slider is vulnerable to Arbitrary Code Execution. The vulnerability is due to insufficient validation of uploaded files, where the mcsdetailimg parameter in the saveDetailsForm endpoint accepts malicious file uploads, and attackers can exploit this to upload executable...

EUVD-2025-199960

A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation of the argument filedatas causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the...

Security Bulletin: Due to the use of Apache Tomcat, IBM ApplinX is vulnerable to a Path Equivalence: 'file.name' (Internal Dot) vulnerability (CVE-2025-24813).

Summary Due to the use of Apache Tomcat, IBM ApplinX is vulnerable to a Path Equivalence: 'file.name' Internal Dot vulnerability CVE-2025-24813. Apache Tomcat has been updated within IBM ApplinX in order to address the vulnerability. Vulnerability Details CVEID:CVE-2025-24813 DESCRIPTION: Path...