PT-2025-17477 · Unknown · Codecanyon Rise Ultimate Project Manager

Name of the Vulnerable Software and Affected Versions: CodeCanyon RISE Ultimate Project Manager version 3.8.2 Description: A problem was found in the file /index.php/team members/save profile image/ of the component Profile Picture Handler. The manipulation of the argument profile image file lead...

Personal Management System 安全漏洞

Personal Management System is a web application for managing personal data by Dariusz Personal Developer. A security vulnerability exists in Personal Management System v1.4.65, which stems from the injection of a specially crafted payload into the tag parameter in the Image Upload section, which...

CodeCanyon RISE Ultimate Project Manager 安全漏洞

CodeCanyon RISE Ultimate Project Manager is a project management and CRM software from CodeCanyon USA. A security vulnerability exists in CodeCanyon RISE Ultimate Project Manager version 3.8.2, which stems from an improper resource identifier control in file /index.php/teammembers/saveprofileimag...

CVE-2025-3558

A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has...

My-Blog-layui 代码问题漏洞

My-Blog-layui is a blog system developed by ZHENFENG13. A code issue exists in My-Blog-layui version 1.0, the vulnerability stems from the wrong operation of the parameter File in the file /admin/upload/authorImg/, which leads to the upload of arbitrary files...

Server Side Request Forgery (SSRF)

shopxo/shopxo is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs in the image upload function, allowing attackers to craft requests that the server executes on their behalf...

WordPress plugin WP Project Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-32409

Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image signed with debug keys can be sent to TCP port 60002, and placed into the correct image-update location as a consequence of both directory traversal and unintended handling of...

CVE-2025-31611

Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through = 1.6...

WordPress Auto Post After Image Upload plugin <= 1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Auto Post After Image Upload versions = 1.6...

CVE-2025-31611

Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through = 1.6...

CVE-2025-31611

Technical details about CVE-2025-31611 (Auto Post After Image Upload) are not provided in the connected documents. Monitor for updates and official remediation information.

CVE-2025-31611 WordPress Auto Post After Image Upload plugin <= 1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through = 1.6...

CVE-2025-28092

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

Server-side Request Forgery (SSRF)

Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the image upload function. An attacker can manipulate the server into making unintended requests by supplying malicious URLs or inputs. Remediation There is no...

ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

GHSA-P736-G6PG-HJHW ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

WordPress plugin Inline Image Upload for BBPress 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2025-28092

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

WordPress Inline Image Upload for BBPress plugin <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by yudha in WordPress Plugin Inline Image Upload for BBPress versions = 1.1.19...