5524 matches found
CVE-2025-24291
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation,...
CVE-2025-34511
Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager XM and Experience Platform XP, through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remot...
CVE-2025-6220
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...
CVE-2025-52921
Innoshop up to version 0.4.1 contains a server-side code execution flaw in the File Manager of the admin panel. An authenticated attacker can upload a crafted file and bypass the image-only check by renaming the file to a .php extension (renaming function), enabling a subsequent GET request to ex...
CVE-2025-4102
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...
CVE-2025-4102
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...
CVE-2025-47559
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.7.4...
CVE-2025-32510
Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue affects Ovatheme Events Manager: from n/a through = 1.8.4...
CVE-2025-6266 Teledyne FLIR AX8 upload.php unrestricted upload
A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public...
CVE-2025-24291
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation,...
CVE-2025-23171
The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filenam...
CVE-2025-24291
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation,...
CVE-2025-24291
Versa Director SD-WAN orchestration platform contains a vulnerability in the Java file-upload handling where argument-injection in the filename bypasses MIME-type validation, enabling uploading of arbitrary file types and placement of a malicious file on disk. Exploitation status in sources is no...
CVE-2025-23171
The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filenam...
CVE-2025-6220
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...
CVE-2025-6220 Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...
PT-2025-26193 · Versa · Versa Director Sd-Wan Orchestration Platform
Name of the Vulnerable Software and Affected Versions: Versa Director SD-WAN orchestration platform affected versions not specified Description: The Versa Director SD-WAN orchestration platform has an issue with file upload permissions, allowing authenticated attackers to upload arbitrary files,...
PT-2025-26197 · Versa · Versa Director Sd-Wan Orchestration Platform
Name of the Vulnerable Software and Affected Versions: Versa Director SD-WAN orchestration platform affected versions not specified Description: The issue concerns the Java code handling file uploads in the Versa Director SD-WAN orchestration platform, which contains an argument injection...
