EUVD-2025-204371

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute i...

CVE-2020-36891

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute i...

CVE-2020-36891 Kentico Xperience <= 12.0.49 File Upload Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute i...

PT-2025-52299

Name of the Vulnerable Software and Affected Versions Kentico Xperience affected versions not specified Description A stored cross-site scripting issue exists in Kentico Xperience. Attackers can upload files with a manipulated Content-Type that does not align with the file extension. This allows...

CVE-2020-36891: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute i...

OneDrive / SharePoint Backup Fails with "Error: Invalid MIME content-length header encountered on read."

Challenge A backup job for OneDrive or SharePoint items processed by Veeam Backup for Microsoft 365 fails when attempting to download certain item versions, displaying the following error: Invalid MIME content-length header encountered on read Cause The issue is related to the download process us...

Security Bulletin: Rational Performance Tester contains vulnerabilities which could affect its use of the MIME4J library

Summary Due to the use of the MIME4J library, Rational Performance Tester contains vulnerabilities that could result in improper input validation. Vulnerability Details CVEID:CVE-2024-21742 DESCRIPTION: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM...

EUVD-2025-203000

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.23. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...

CVE-2025-12968 Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...

CVE-2025-12968

CVE-2025-12968 covers the Infility Global WordPress plugin. Wordfence details show an Authenticated (Subscriber+) Arbitrary File Upload vulnerability caused by: (1) upload_file MIME type validation, which can be spoofed, and (2) missing capability checks in import_data. Affected versions are up t...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2025:4336-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4336-1 advisory. go1.25.5 released 2025-12-02 includes two security fixes to the crypto/x509 package, as well as...

Security update for go1.25

This update for go1.25 fixes the following issues: go1.25.5 released 2025-12-02 includes two security fixes to the crypto/x509 package, as well as bug fixes to the mime and os packages. bsc1244485 CVE-2025-61729 CVE-2025-61727: go76461 go76445 bsc1254431 security: fix CVE-2025-61729 crypto/x509:...

[SECURITY] Fedora 43 Update: kf6-kcoreaddons-6.20.0-2.fc43

KCoreAddons provides classes built on top of QtCore to perform various tasks such as manipulating mime types, autosaving files, creating backup files, generating random sequences, performing text manipulations such as macro replacement, accessing user information and many more...

RockyLinux 8 : container-tools:4.0 (RLSA-2023:6938)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6938 advisory. go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handli...

EUVD-2025-199676

Unauthenticated Arbitrary File Upload patchcontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patchcontents.php allows uploading malicious files...

CVE-2025-66256

The CVE concerns a vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter series (versions 30–7000) where the /var/tdf/patch_contents.php endpoint allows unauthenticated, unrestricted file uploads. There is no file type validation, MIME checking, or size restriction beyond...

Siemens SIMATIC S7-1500 Improper Neutralization of Special Elements used in a Command (CVE-2014-7209)

run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2025-8871

The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...

CVE-2025-8871

The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...

CVE-2025-8871 Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature

The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...