EUVD-2024-16698

Malicious code in bioql PyPI...

EUVD-2021-31416

Malicious code in bioql PyPI...

EUVD-2025-28003

Malicious code in bioql PyPI...

CVE-2025-8120

Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, b...

CVE-2025-7063

Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, b...

PT-2025-39159

Name of the Vulnerable Software and Affected Versions Product Options and Price Calculation Formulas for WooCommerce – Uni CPO Premium versions through 4.9.54 Description The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO Premium plugin for WordPress has an issue with fi...

CVE-2025-57176

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption metadata only with file contents...

CVE-2025-57176

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption metadata only with file contents...

PT-2025-37368

Name of the Vulnerable Software and Affected Versions Siklu Communications Etherhaul 8010TX and 1200FX devices versions 7.4.0 through 10.7.3 Description An issue exists in the rfpiped service, listening on TCP port 555, which utilizes static AES encryption keys hardcoded within the binary. These...

CVE-2025-10267

NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files. If the attacker manages to bypass the file extension restrictions, they could upload a webshell and execute it on the server side...

WordPress Goza theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation vulnerability

Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation vulnerability discovered by GR0V in WordPress Theme Goza versions = 3.2.2...

WordPress Doccure plugin <= 1.4.8 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Theme Doccure versions = 1.4.8...

CVE-2025-34163 Dongsheng Logistics Software Unauthenticated Arbitrary File Upload

Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST reques...

Securden Unified PAM 安全漏洞

Securden Unified PAM is a privileged access management software from Securden, Inc. A security vulnerability exists in Securden Unified PAM that stems from unauthenticated file upload functionality with path traversal, which could lead to remote code execution...

PT-2025-34676 · Unknown · File Upload

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server. Recommendations: At the moment, there is no information about a...

CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files'...

CVE-2012-10038

Auxilium RateMyPet is affected by an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature does not validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files that are stored in a web-accessible /banners/ d...

CVE-2012-10038 Auxilium RateMyPet Arbitrary File Upload RCE

Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in uploadbanners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/...

PT-2025-32551 · Unknown · Auxilium Ratemypet

Name of the Vulnerable Software and Affected Versions: Auxilium RateMyPet affected versions not specified Description: Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in the upload banners.php file. The banner upload feature does not validate file types or requi...

CVE-2012-10052

EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory...