EUVD-2024-38849

Malicious code in bioql PyPI...

EUVD-2025-25287

Malicious code in bioql PyPI...

EUVD-2023-33989

Malicious code in bioql PyPI...

EUVD-2022-44458

Malicious code in bioql PyPI...

EUVD-2022-36211

Malicious code in bioql PyPI...

EUVD-2022-41724

Malicious code in bioql PyPI...

EUVD-2021-9931

Malicious code in bioql PyPI...

EUVD-2021-8455

Malicious code in bioql PyPI...

EUVD-2024-31724

Malicious code in bioql PyPI...

EUVD-2025-18994

Malicious code in bioql PyPI...

CVE-2025-60451

MetInfo CMS 8.0 contains a stored XSS due to insufficient validation/sanitization of SVG uploads in the website settings module, specifically in app/system/include/module/uploadify.class.php. The issue allows uploaded SVGs with JavaScript to execute when viewed. CVSS 3.1 base score 6.1 (Network a...

PT-2025-38704

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions prior to 5.11.73 Description A flaw exists in the admin "Restore" function that allows attackers with admin credentials to execute arbitrary code on the server. This is possible through the upload of malicious .php files...

Mobile Shop Management System AddNewProduct.php file code problem vulnerability

Mobile Shop Management System is a store management system. Mobile Shop Management System has a code issue vulnerability that stems from the lack of valid validation of uploaded files in the parameter ProductImage in the file AddNewProduct.php. An attacker can exploit this vulnerability to upload...

Mobile Shop Management System 代码问题漏洞

Mobile Shop Management System is a store management system. Mobile Shop Management System has a code issue vulnerability that stems from the lack of valid validation of uploaded files in the parameter ProductImage in the file AddNewProduct.php. An attacker can exploit this vulnerability to upload...

HCL BigFix SM 安全漏洞

HCL BigFix SM is an AI-driven service management platform module from HCL India. A security vulnerability exists in HCL BigFix SM, which stems from a file upload validation bypass that could lead to the upload of malicious files...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the user creation process via the /admin/settings/users/create endpoint, where file uploads are insufficiently sanitized due to improper MIME type validation. An attacker can execute arbitrary JavaScript in t...

CVE-2025-54926

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed...

CVE-2025-6076 CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

CVE-2014-125126

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header access=3 with HTTP requests. The application’s upload mechanism fails to restrict file types and does not...

CVE-2014-125126 Simple E-Document Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header access=3 with HTTP requests. The application’s upload mechanism fails to restrict file types and does not...