46717 matches found
CVE-2025-48106 WordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through 1.3.1...
CVE-2025-48106
CVE-2025-48106 corresponds to an Arbitrary File Upload vulnerability in the WordPress Clanora theme/plugin (CMSSuperHeroes Clanora) affecting versions prior to 1.3.1. The issue is described as Unrestricted Upload of File with Dangerous Type, arising from insufficient validation of uploaded files,...
CVE-2025-48106 WordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through 1.3.1...
CVE-2025-60500
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a...
CVE-2025-41723
CVE-2025-41723 affects SAUTER products (EY-modulo 5 Building Automation, modulo 6 devices modu680-AS, modu660-AS, modu612-LC, plus related ecos variants) via the importFile SOAP method, which is vulnerable to directory traversal. An unauthenticated remote attacker can bypass path restrictions and...
EUVD-2025-35335
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations...
CVE-2025-41723 Sauter: Directory Traversal in importFile SOAP Method
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations...
CVE-2025-41720 Sauter: Arbitrary File Upload
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified...
CVE-2025-41720 Sauter: Arbitrary File Upload
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified...
CVE-2025-61181
daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature...
VulnCheck KEV: CVE-2023-53691
Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wild in 2024 and 2025...
CVE-2023-53691
Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wild in 2024 and 2025...
PT-2025-43139
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.7 through 18.3.5 GitLab CE/EE versions 18.4 through 18.4.3 GitLab CE/EE versions 18.5 through 18.5.1 Description An unauthenticated attacker could create a denial of service condition by uploading large files to specif...
PT-2025-43164
Name of the Vulnerable Software and Affected Versions CMSSuperHeroes Wastia versions prior to 1.1.3 Description A flaw exists in CMSSuperHeroes Wastia that permits the unrestricted upload of files with dangerous types. This allows for the upload of a Web Shell to a Web Server. Recommendations...
PT-2025-43278
Name of the Vulnerable Software and Affected Versions 7oroof Medcity versions prior to 1.1.9 Description The software contains a flaw that permits the upload of files with dangerous types. This allows for the upload of a web shell to a web server. Recommendations Update to version 1.1.9 or later...
CVE-2023-53691
CVE-2023-53691 affects Hikvision CSMP iSecure Center prior to or through 2023-06-25, where a directory traversal flaw in /center/api/files enables file upload. Exploitation has been observed in the wild during 2024 and 2025. The vulnerability arises from improper handling of file paths in the fil...
SAUTER多款产品 安全漏洞
SAUTER EY-modulo 5 Building Automation Station is a complete building management solution from SAUTER.Sauter modu680-AS is a modular automation station cum web server from Sauter, Switzerland. A security vulnerability exists in several SAUTER products. The vulnerability stems from the importFile...
WordPress plugin Clanora 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file upload vulnerability exists in the WordPress Clanora plugin that stems from the application's lack of effective validation of uploaded files. The vulnerability can be...