CVE-2024-8028

CVE-2024-8028 affects danswer-ai/danswer v0.3.94. A crafted request with a malformed multipart boundary enables a DoS by appending many characters to the boundary; the server processes each character, rendering the application inaccessible and impacting all users. The connected sources confirm th...

Exploit for Missing Authorization in Directsoftware Order_Attachments_For_Woocommerce

🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756...

CVE-2024-8279

A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads...

CVE-2025-22132 WeGIA has a Cross-Site Scripting (XSS) in File Upload Field

WeGIA is a web manager for charitable institutions. A Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controlaxlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute...

PT-2024-6031

Name of the Vulnerable Software and Affected Versions: Versa Director versions prior to 22.1.4 Description: The vulnerability in Versa Director allows attackers to upload malicious files, posing a serious threat to organizations. This flaw can be exploited by authenticated users with...

CVE-2024-2299 Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui

A stored Cross-Site Scripting XSS vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is...

PT-2022-8698 · B. Braun Melsungen Ag · Data Module Compactplus +1

Name of the Vulnerable Software and Affected Versions: B. Braun Melsungen AG SpaceCom versions L81/U61 and earlier B. Braun Melsungen AG Data module compactplus versions A10 and A11 Description: A relative path traversal attack allows attackers with service user privileges to upload arbitrary...