Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the showUploadForm method, any malicious unauthenticated user can create a link that can be clicked on in the victim context to perform arbitrary actions. An attacker can execute arbitrary JavaScript code by...

BeyongCms code issue vulnerabilities

BeyongCms is a lightweight content management system by youyiio individual developer. A code issue vulnerability exists in BeyongCms version 1.6.0, which stems from the incorrect operation of the parameter File in the file /admin/theme/Upload.html leading to unlimited uploads...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

My-Blog-layui code issues and vulnerabilities

My-Blog-layui is a blog system developed by ZHENFENG13. A code issue exists in My-Blog-layui version 1.0, the vulnerability stems from the wrong operation of the parameter File in the file /admin/upload/authorImg/, which leads to the upload of arbitrary files...

uzy-ssm-mall code issue vulnerabilities

uzy-ssm-mall yuzu cloud e-commerce is an SSM framework by ghostxbh personal developer for building e-commerce, bookstore mall, customer management and so on. A code issue vulnerability exists in uzy-ssm-mall version 1.0.0, which stems from improper manipulation of the parameter File in the file...

AIAS security vulnerabilities

AIAS is an AI one-stop solution from Calvin Personal Developer. A security vulnerability exists in AIAS version 20250308, which stems from the fact that incorrect manipulation of the parameter File can lead to unrestricted uploads...

iboot security vulnerability

iboot is a general-purpose IoT gateway, industrial IoT gateway system by iteaj individual developer. A security vulnerability exists in iboot version 1.1.3, which stems from the mishandling of the parameter File in the file upload component /common/upload/batch, which could lead to a cross-site...

Nimrod code issues and vulnerabilities

nimrod is a Spring Boot-based enterprise-grade monolithic application rapid development framework for the Java Web platform by the individual developer godcheese. A code issue vulnerability exists in nimrod version 0.8, which stems from an incorrect operation of the parameter File that can lead t...

iboot security vulnerability

iboot is a general-purpose IoT gateway, industrial IoT gateway system by iteaj individual developer. A security vulnerability exists in iboot version 1.1.3, which stems from an incorrect manipulation of the parameter File can lead to cross-site scripting...

CVE-2025-3021

Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside the expected scope via the ‘file’ parameter in the /downloadReport.php endpoint...

PT-2025-13682

Name of the Vulnerable Software and Affected Versions e-solutions e-management affected versions not specified Description The issue allows an attacker to access confidential files outside the expected scope via the file parameter in the "/downloadReport.php" endpoint. This could potentially lead...

CVE-2025-3021: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside the expected scope via the ‘file’ parameter in the /downloadReport.php endpoint...

GPT Academic Open Redirect Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from an open redirection vulnerability that originates from a user redirecting to a URL specified by the user-controlled file parameter without proper validation o...

ruoyi-vue-pro path traversal vulnerability

ruoyi-vue-pro is the Taro Road source code zhijiantianya open source an optimized refactored efficient backend management system framework for the development of enterprise backend , SaaS platform , WeChat small program backend and so on. ruoyi-vue-pro 2.4.1 version of a security vulnerability ,...

ruoyi-vue-pro path traversal vulnerability

ruoyi-vue-pro is the Taro Road source code zhijiantianya open source an optimized refactored efficient backend management system framework for the development of enterprise backend , SaaS platform , WeChat small program backend and so on. ruoyi-vue-pro 2.4.1 version of a security vulnerability ,...

ruoyi-vue-pro path traversal vulnerability

ruoyi-vue-pro is Taro source code zhijiantianya open source an optimized and refactored efficient backend management system framework for the development of enterprise backend , SaaS platform , WeChat small program backend and so on. ruoyi-vue-pro 2.4.1 version of the path traversal vulnerability...

CVE-2025-2705: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

LzCMS code-related vulnerabilities

LzCMS is a simple blogging system by the individual developer of phplaozhang. A code issue vulnerability exists in LzCMS 1.1.4 and earlier versions, which stems from improper operation of the File parameter in the /admin/upload/upimage.html file, which may result in arbitrary file uploads...

CVE-2024-10812

An open redirect vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-controlled input in the 'file' parameter without proper validation or sanitization. This can be exploited by attackers to conduct phishing...