5523 matches found
PT-2025-20423 · Unknown · Grocery-Cms-Php-Restful-Api
Name of the Vulnerable Software and Affected Versions: Grocery-CMS-PHP-Restful-API version 1.3 Description: The issue concerns a file upload vulnerability via the "/admin/add-category.php" API endpoint. This allows for potential malicious file uploads. Recommendations: For...
CVE-2023-31585
Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to a file upload flaw via /admin/add-category.php. The issue, confirmed across multiple sources, permits uploading arbitrary files, with CVSS v3.1 indicating Network attack, no privileges required, no user interaction, and high impact to confidential...
Exploit for Unrestricted Upload of File with Dangerous Type in Themefic Ultimate_Before_After_Image_Slider_\&_Gallery
Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mt...
Cisco IOS XE Wireless Controller Software Arbitrary File Upload Vulnerability
A vulnerability in the Out-of-Band Access Point AP Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. Th...
CVE-2025-47550 WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Instantio: from n/a through = 3.3.16...
CVE-2025-47550 WordPress Instantio <= 3.3.16 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio allows Upload a Web Shell to a Web Server. This issue affects Instantio: from n/a through 3.3.16...
CVE-2025-47549 WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through = 4.6.10...
CVE-2025-28168
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension...
PT-2025-20162 · Unknown · Themefic Beaf
Name of the Vulnerable Software and Affected Versions: Themefic BEAF versions through 4.6.10 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized access to the server...
PT-2025-20163 · Unknown · Themefic Instantio
Name of the Vulnerable Software and Affected Versions: Themefic Instantio versions n/a through 3.3.16 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...
CVE-2025-0984 Arbitrary File Upload in Netoloji Software's E-Flow
Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue...
mayi 代码问题漏洞
mayi is shuiyueju open source a performance management system . mayi 1.3.9 and previous versions of the code problem vulnerability , the vulnerability stems from the file app/tools/controller/File.php function Upload on the parameter File mishandling , may lead to arbitrary file upload...
CVE-2025-46730 Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack
MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications. Access to the MobSF web interface is often granted to internal security teams, audit teams, and external...
newbee-mall 代码问题漏洞
newbee-mall is a newbee open source e-commerce system. A code issue vulnerability exists in version 1.0 of newbee-mall, which stems from improper handling of the parameter File in the file ltd/newbee/mall/controller/common/UploadController.java, which could lead to arbitrary file uploads...
PT-2025-19707 · Outsystems · Outsystems
Name of the Vulnerable Software and Affected Versions: Outsystems versions prior to 3.1.0 Description: The issue arises because file extension and size validations are enforced solely on the client side in the Outsystems Multiple File Upload feature. This allows an attacker to intercept the uploa...
File Upload Vulnerability in Multi-service Intelligent Gateway of Resconda Technology Development Co.
Focusing on the field of fiber optic broadband access, Riseconda Technology Development Co., Ltd. is committed to the convergence of fiber optic technology, Ethernet technology and broadband access technology. A file upload vulnerability exists in the Multi-service Intelligent Gateway of Risconda...
PT-2025-19772
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.6 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Low-privileged users can upload HTML files containing JavaScript code via the "/api/v1/files/"...
CVE-2024-11390
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser XSS via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices...