5526 matches found
Cisco Identity Services Engine Arbitrary File Upload Vulnerability
A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy...
CVE-2025-29093
File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component...
PT-2025-23811 · Unknown · Motivian Content Management System
Name of the Vulnerable Software and Affected Versions: Motivian Content Management System version 41.0.0 Description: The issue allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component. This is a result of a File Upload vulnerability. Recommendations: For Motivi...
VulnCheck KEV: CVE-2025-3054
The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
CVE-2025-29093
CVE-2025-29093 affects Motivian Content Management System, v41.0.0, through the vulnerable component Content/Gallery/Images . The root cause is a File Upload weakness that allows remote attackers to upload arbitrary files, potentially enabling code execution. Evidence across connected docs includ...
Cisco Identity Services Engine (cisco-sa-ise-file-upload-P4M8vwXY)
According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an...
CVE-2025-5523
A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site...
CVE-2025-5523 enilu web-flash File Upload upload fileService.upload cross site scripting
A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site...
CVE-2025-5523
CVE-2025-5523 affects enilu web-flash 1.0. The vulnerability resides in the fileService.upload function of FileController/upload (File Upload component). Manipulating the File argument leads to cross-site scripting, and exploitation can be performed remotely. The CVE description notes that the ex...
CVE-2025-48953
Umbraco is an ASP.NET content management system CMS. Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and...
CVE-2025-48953 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Umbraco is an ASP.NET content management system CMS. Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and...
CVE-2025-48953
Umbraco CMS (ASP.NET) has a file-upload bypass vulnerability: in versions 14.0.0 up to but not including 15.4.2 and 16.0.0, an API request can be manipulated to upload a file that doesn’t conform to the configured allowed extensions. The issue is fixed in 15.4.2 and 16.0.0. There are no publicly ...
Erupt Unrestricted Upload of File with Dangerous Type vulnerability
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
PT-2025-23631 · Jehc-Bpm · Jehc-Bpm
Name of the Vulnerable Software and Affected Versions: JEHC-BPM version 2.0.1 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file to the "/server/executeExec" API endpoint. This is due to an arbitrary file upload vulnerability in the component...
Document Uploading Vulnerability in Online Entrustment System of Zhuhai Xinhua Tong Software Co.
Zhuhai Xinhua Tong Software Co., Ltd. is a professional software company focusing on the research and development of informatization products and services in the industries of smart city and smart housing construction. A file upload vulnerability exists in the online entrustment system of Zhuhai...
CVE-2024-7074
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an...
CVE-2025-45997
Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can upload a PHP file disguised as an image by modifying the Content-Type header to image/jpg...
CVE-2025-48471
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of files uploaded to the application. This allows files to be uploaded with the phtml and phar extensions, which can lead to remote code executi...
CVE-2025-46080
HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server...
