CKFinder 安全漏洞

CKFinder is an intelligent WYSIWYG editor component with collaborative editing capabilities. A security vulnerability exists in CKFinder version 1.4.3, which stems from a cross-site scripting vulnerability in the file upload feature that could lead to the upload of malicious SVG files...

CVE-2025-63830

CKFinder 1.4.3 is affected by a Cross Site Scripting (XSS) vulnerability in the File Upload feature. An attacker can upload a crafted SVG that contains active content, potentially executing script in the context of a user’s browser. This affects the CKFinder 1.4.3 release as described across mult...

Intel CIP Code Issue Vulnerability

Intel CIP is an optional program from Intel designed to improve products by collecting performance data from users' computers. Intel CIP has a code issue vulnerability that stems from an unrestricted upload of dangerous types of files, which can be exploited by attackers to cause data tampering...

CVE-2025-63830

CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...

CVE-2025-63830

CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...

CVE-2025-64747

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

CVE-2025-64747 Directus Vulnerable to Stored Cross-site Scripting

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

CVE-2025-12048

An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system...

Cross-site Scripting (XSS)

Overview privatebin/privatebin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the drag-and-drop helper when handling filenames containing HTML content. An attacker ca...

PT-2025-46912

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0 Description Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS issue exists that allows users with upload files and edit item permissions to...

Generex UPS Adapter CS141 Improper Neutralization of Input During Web Page Generation (CVE-2022-47187)

There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file. This plugin only works with Tenable.ot...

Generex UPS Adapter CS141 Unrestricted Upload of File with Dangerous Type (CVE-2022-47186)

There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the upload directory. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 Unrestricted Upload of File with Dangerous Type (CVE-2019-19925)

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

CVE-2025-13061

A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=managevoting. Performing manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-13061 itsourcecode Online Voting System index.php unrestricted upload

A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=managevoting. Performing manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-13061

The connected sources confirm a concrete vulnerability in itsourcecode Online Voting System 1.0 related to unrestricted file uploads. The issue stems from a lack of validation for uploaded files via the /index.php?page=manage_voting (CNVD and NVD descriptions). This can be triggered remotely and ...

CVE-2025-12048

An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system...

CVE-2025-12048

An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system...

CVE-2025-12048

An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system...

CVE-2025-12048

CVE-2025-12048 affects Lenovo Scanner Pro client. The vulnerability is an arbitrary file upload flaw in the client that could lead to remote code execution or unauthorized control of the affected system. The root cause is stated as an arbitrary file upload capability, enabling control if exploite...