CVE-2025-54449

CVE-2025-54449 affects Samsung MagicINFO 9 Server, with versions prior to 21.1080.0 vulnerable to an unrestricted upload of files with dangerous types, enabling remote code execution. The issue stems from lack of proper validation during file upload (fillLftOrLfdInfo in the ZDI advisory aligns wi...

CVE-2025-54449

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0...

PT-2025-30530 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A flaw exists in Samsung Electronics MagicINFO 9 Server that allows code injection through the unrestricted upload of files with dangerous types. Recommendations: Update MagicINFO 9...

PT-2025-30529 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: An unrestricted file upload of dangerous file types in Samsung Electronics MagicINFO 9 Server allows for code injection. Recommendations: MagicINFO 9 Server versions prior to...

PT-2025-30535 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A flaw exists in Samsung Electronics MagicINFO 9 Server that allows code injection through the unrestricted upload of files with dangerous types. Recommendations: Update MagicINFO 9...

PT-2025-30527 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: An unrestricted file upload issue with dangerous file types exists in Samsung Electronics MagicINFO 9 Server, potentially leading to code injection. Recommendations: Update MagicINFO...

SAMSUNG MagicINFO 9 Server 安全漏洞

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. SAMSUNG MagicINFO 9 Server suffers from a file upload vulnerability that originates from allowing the upload of dangerous types of files, which can be exploited ...

SAMSUNG MagicINFO 9 Server 安全漏洞

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. A file upload vulnerability exists in SAMSUNG MagicINFO 9 Server, which stems from a failure to perform strict checks on uploaded file types. An attacker can...

SAMSUNG MagicINFO 9 Server 安全漏洞

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. SAMSUNG MagicINFO 9 Server suffers from a file upload vulnerability that originates from allowing the upload of dangerous types of files, which can be exploited ...

CVE-2025-47187

The vulnerability CVE-2025-47187 affects Mitel 6800 Series, Mitel 6900 Series, Mitel 6900w Series SIP Phones (up to 6.4 SP4 R6.4.0.4006) and the 6970 Conference Unit (up to 6.4 SP4 R6.4.0.4006 or V1 R0.1.0). It arises from missing authentication, allowing an unauthenticated attacker to upload arb...

CVE-2025-51475

Arbitrary File Overwrite AFO in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join and lac...

CVE-2025-51459

File Upload vulnerability in agent.hub.controller.refreshplugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with pluginhub.sanitizefilename and pluginsutil.scanplugi...

Exploit for CVE-2025-34085

📌 CVE-2025-34085 — Simple File List WordPress Plugin RCE 📌...

CVE-2015-10137

The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadfile' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2012-10020

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

CVE-2015-10137

The CVE-2015-10137 entry concerns the WordPress plugin “Website Contact Form With File Upload” with vulnerabilities up to version 1.3.4, caused by missing file type validation in upload_file(); this allows unauthenticated arbitrary file uploads on affected servers and may enable remote code execu...

PT-2025-30373

Name of the Vulnerable Software and Affected Versions Website Contact Form With File Upload for WordPress versions up to 1.3.4 Description The Website Contact Form With File Upload plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation within the...

CVE-2025-51475

Arbitrary File Overwrite AFO in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join and lac...

PT-2025-30455 · Unknown · Transformeroptimus/Superagi

Name of the Vulnerable Software and Affected Versions: TransformerOptimus SuperAGI version 0.0.14 Description: An arbitrary file overwrite issue exists in the superagi.controllers.resources.upload component. This allows remote attackers to overwrite arbitrary files by submitting unsanitized...

CVE-2025-51459

File Upload vulnerability in agent.hub.controller.refreshplugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with pluginhub.sanitizefilename and pluginsutil.scanplugi...