CVE-2024-13908

The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2024-13908

CVE-2024-13908 pertains to the WordPress plugin SMTP by BestWebSoft, where arbitrary file uploads are possible due to missing file type validation in the save_options function across versions up to 1.1.9. The vulnerability requires authenticated Administrator+-level access to exploit and may enab...

PT-2025-10421 · WordPress · The Aiomatic

Name of the Vulnerable Software and Affected Versions: The Aiomatic - Automatic AI Content Writer & Editor plugin for WordPress versions up to, and including, 2.3.8 Description: The issue is related to arbitrary file uploads due to missing file type validation in the aiomatic generate featured...

WordPress plugin Product Input Fields for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2024-13805

CVE-2024-13805 concerns the Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin for WordPress. It is reported as vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to and including 5.2.14 due to insufficient input sanitization and out...

CVE-2024-13805 Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

PT-2025-10078

Name of the Vulnerable Software and Affected Versions The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin versions up to, and including, 5.2.14 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

CVE-2024-13805: Improper Neutralization of Input During Web Page Generation

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

The vulnerability of the Kibana data visualization service is related to uncontrolled changes in object prototype attributes, allowing attackers to execute arbitrary code.

The vulnerability of the Kibana data visualization service is related to uncontrolled changes in object prototype attributes. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted HTTP request or uploading a specially created file...

Linux Distros Unpatched Vulnerability : CVE-2023-49090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability,...

REDAXO 代码问题漏洞

REDAXO is a content management system from REDAXO open source. A code issue vulnerability exists in REDAXO versions prior to 5.18.3 that stems from allowing arbitrary file uploads...

Linux Distros Unpatched Vulnerability : CVE-2021-41868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality. CVE-2021-41868 No...

CVE-2025-1307

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-1307

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-1306

The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...

CVE-2025-1307

CVE-2025-1307 affects the Newscrunch WordPress theme; versions up to 1.8.4.1 are vulnerable to an arbitrary file upload due to a missing capability check in newscrunch_install_and_activate_plugin(). Affected attackers: authenticated users with Subscriber+ privileges; impact includes potential rem...

Linux Distros Unpatched Vulnerability : CVE-2016-10712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of streamgetmetadata can be controlled if the input can be controlled...

The vulnerability in the application software interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload files and gain access to read, modify, or delete data.

The vulnerability of the application programming interface of the Cisco Identity Services Engine ISE management platform is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to upload files and gain read,...

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics allows a malicious actor to gain unauthorized access to the system by allowing unlimited upload of sensitive files.

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics is related to the unlimited uploading of dangerous files. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the system by uploading a...

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics allows a malicious actor to gain unauthorized access to the system by allowing unlimited upload of sensitive files.

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics is related to the unlimited uploading of dangerous files. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the system by uploading a...