CVE-2024-13117 Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal

The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded...

CVE-2024-13117

CVE-2024-13117 affects Social Share Buttons for WordPress (plugin) up to version 2.7, allowing unauthenticated users to upload arbitrary images and alter the upload path. Root cause: improper upload handling enabling arbitrary file upload and path traversal. Impact: potential for arbitrary file u...

WordPress plugin Social Share Buttons 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2024-13698 Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation

The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'downloadimageviaai' and 'generateimageviaai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticat...

CVE-2024-13698 Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation

The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'downloadimageviaai' and 'generateimageviaai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticat...

PT-2025-2247 · WordPress · Jobify

Name of the Vulnerable Software and Affected Versions: Jobify - Job Board WordPress Theme for WordPress versions up to, and including, 4.2.7 Description: The issue concerns unauthorized access and modification of data due to a missing capability check in the download image via ai and generate ima...

CVE-2024-13361

The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicgsaveimagemedia function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2024-40514

Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions...

CVE-2024-40513

An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function...

PT-2025-2583 · Themesebrand · Themesebrand Chatvia

Name of the Vulnerable Software and Affected Versions: themesebrand Chatvia version 5.3.2 Description: An issue in themesebrand Chatvia allows a remote attacker to execute arbitrary code via the User profile Upload image function. Recommendations: For themesebrand Chatvia version 5.3.2, consider...

CVE-2024-40513

An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function...

Themesbrand ChatVia 安全漏洞

Themesbrand ChatVia is a responsive chat application from Themesbrand. A security vulnerability exists in Themesbrand ChatVia version 5.3.2, which originates from a vulnerability that allows remote attackers to execute arbitrary code via the user profile image upload function...

Themesbrand Chatvia 安全漏洞

Themesbrand ChatVia is a responsive chat application from Themesbrand. A security vulnerability exists in Themesbrand Chatvia version 5.3.2, which stems from the presence of an insecure privilege vulnerability that allows an attacker to elevate privileges via the user's profile name and image...

CVE-2024-54730

Flatnotes v5.3.1 is vulnerable to denial of service through the upload image function...

PT-2025-3065 · Flatnotes · Flatnotes

Name of the Vulnerable Software and Affected Versions: Flatnotes versions prior to 5.3.1 Description: The issue is related to a denial of service through the upload image function. There is no information provided about the estimated number of potentially affected devices worldwide or real-world...

CVE-2024-54730

CVE-2024-54730 covers a denial-of-service in Flatnotes versions prior to 5.3.1, caused by the image upload function. The vulnerability is observed in the web interface where uploading an image can exhaust resources, leading to service disruption. Public records across multiple sources confirm the...

flatnotes 安全漏洞

flatnotes is a self-hosted, database-less notes web application by the individual developer Adam Dullage. A security vulnerability exists in flatnotes version v5.3.1 that originates from a denial of service via the upload image feature...

PT-2025-3896 · Opencart · Blog Botz For Journal Theme

Name of the Vulnerable Software and Affected Versions: Blog Botz for Journal Theme version 1.0 on OpenCart Description: A critical vulnerability was found in Blog Botz for Journal Theme on OpenCart, affecting an unknown part of the file /index.php?route=extension/module/blog add. The manipulation...

CVE-2025-0335

A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been...

CVE-2025-0335

A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been...