5523 matches found
PT-2025-16499
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An attacker can upload an arbitrary file instead of a plant image. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...
Exploit for Path Traversal in Ghost
CVE-2023-40028 POC for CVE-2023-40028: Ghost CMS Arbitrary Fil...
CVE-2025-31002
Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: from n/a through = 1.6...
CVE-2025-32579
The CVE-2025-32579 entry concerns the WordPress plugin Sync Posts by SoftClever Limited (versions
CVE-2025-32579 WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts allows Upload a Web Shell to a Web Server. This issue affects Sync Posts: from n/a through 1.0...
CVE-2025-32028
HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is...
CVE-2025-30017
Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application...
CVE-2025-32215
Unrestricted Upload of File with Dangerous Type vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Stored XSS.This issue affects Accessibility Suite: from n/a through = 4.18...
CVE-2025-32202
Unrestricted Upload of File with Dangerous Type vulnerability in Brian Batt - elearningfreak.com Insert or Embed Articulate Content into WordPress insert-or-embed-articulate-content-into-wordpress allows Upload a Web Shell to a Web Server.This issue affects Insert or Embed Articulate Content into...
CVE-2025-32206
CVE-2025-32206 affects WordPress Plugin Processing Projects
CVE-2025-32206 WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This issue affects Processing Projects: from n/a through = 1.0.2...
CVE-2024-47261
51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device...
CVE-2025-29394
An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type...
CVE-2025-31002
CVE-2025-31002 corresponds to an Unrestricted Upload of File with Dangerous Type in the WordPress plugin Squeeze by Bogdan Bendziukov. The vulnerability affects Squeeze versions up to and including 1.6 (no details from the Initial Description beyond the affected range). CVSS 3.1 severity is 9.1 (...
College Management System File Upload Vulnerability
College Management System is a simple program. It is used to keep track of students, teachers, subjects, schedules and all things related to college. A file upload vulnerability exists in College Management System version 1.0, which stems from the lack of valid validation of the uploaded file by...
CVE-2025-29394
CVE-2025-29394 affects verydows v2.0. The issue is an insecure permissions flaw in file uploads that permits a remote attacker to execute arbitrary code. Root cause: improper handling of uploaded files (permissions) enabling code execution. Evidence across sources confirms impact as remote code e...
CVE-2025-3326
A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack can be initiated remotely. The...
CVE-2024-12556 Kibana Prototype Pollution can lead to code injection
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal...
CVE-2025-32035 DNN does not check the contents of a file when uploading files
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 9.13.2, when uploading files e.g. when uploading assets, the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This...