473 matches found
INFINITT Healthcare INFINITT PACS
RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files and access unauthorized system resources, resulting in arbitrary code execution or information disclosure. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...
📄 Invoice 1.0 SQL Injection / Shell Upload
Invoice version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass which in turn could be used to upload a shell. Titles: INVOICE-1.0-Copyright©2025-SQLi-Bypass-Authentication+FU+RCE Author: nu11secur1ty Date: 04/07/2025 Vendor: https://github.com/oretnom2...
CVE-2025-32118 WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.13 - Remote Code Execution (RCE) vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance allows Using Malicious Files. This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.13...
PT-2025-14108
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 137 Thunderbird versions prior to 137 Description The issue allows an unexpected file to be uploaded after selecting a malicious Windows .url shortcut from the local filesystem. This bug only affects Firefox on Window...
CVE-2024-57169
A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploading malicious files...
CVE-2024-9311
A Cross-Site Request Forgery CSRF vulnerability in haotian-liu/llava v1.2.0 LLaVA-1.6 allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code...
CVE-2024-8400
A stored cross-site scripting XSS vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code, which is then executed when the file is accessed. This can lead to the execution of arbitrar...
CVE-2024-12871
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or...
CVE-2025-2495
Stored Cross-Site Scripting XSS in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScript code injected via the ‘/softdial/scheduler/save.php’ resource. The injected code will execute when the uploaded file is loaded via the...
Dotclear 2.29 Shell Upload
Dotclear version 2.29 proof of concept remote shell upload exploit that leverages a previously discovered vulnerability from 2024. ============================================================================================================================================= | Title : Dotclear 2.29...
ChestnutCMS File Upload Vulnerability (CNVD-2025-05386)
ChestnutCMS is a front-end and back-end separated enterprise-level content management system. A file upload vulnerability exists in ChestnutCMS 1.5.2 and earlier versions, which stems from a lack of validation of uploaded files by the parameter file. An attacker can exploit this vulnerability to...
HP Intelligent Management Center 5.1 E0202 Shell Upload
HP Intelligent Management Center version 5.1 E0202 suffers from a remote shell upload vulnerability. ============================================================================================================================================= | Title : HP Intelligent Management Center 5.1 E0202...
Proliz OBS 路径遍历漏洞
Proliz OBS is an application from Proliz, Inc. A path traversal vulnerability exists in Proliz OBS versions prior to 24.0927. An attacker can exploit this vulnerability to remotely execute code by uploading a malicious file...
Wattsense Bridge 6.x Remote Root / Information Disclosure
Wattsense Bridge suffers a multitude of security issues. The JTAG interface can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. A serial interface can be accessed with physical access to the PCB. After connecting to the...
CVE-2025-26350
A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests...
WordPress plugin Brizy 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...
CVE-2021-4096
The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPDAdminImport class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5...
CVE-2024-25034
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attac...
CVE-2024-21778
A heap-based buffer overflow vulnerability exists in the configuration file mibinitvaluearray functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted .dat file can lead to arbitrary code execution. An attacker can upload a malicious file to trigger this vulnerability...