CVE-2025-55912

An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photouploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler...

PT-2025-38416

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.0 Description An issue exists in ClipBucket that allows an unauthenticated attacker to upload arbitrary files via the photo uploader.php plupload endpoint due to missing access controls in the upload handler...

CVE-2025-55912

ClipBucket 5.5.0 and earlier versions are affected by an unauthenticated arbitrary file upload vulnerability in the plupload endpoint at photo_uploader.php due to missing access controls in the upload handler. Exploitation can lead to remote code execution by uploading crafted PHP files (as shown...

CVE-2009-20006

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility admin/filemanager.php. The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to...

ClipBucket 5.5.0 - Arbitrary File Upload

Exploit Title: ClipBucket 5.5.0 - Arbitrary File Upload Google Dork: N/A Date: 2025-09-11 Exploit Author: Mukundsinh Solanki r00td3str0y3r Vendor Homepage: https://clipbucket.com Software Link: https://github.com/MacWarrior/clipbucket-v5 Version: ------BOUND-- The file is uploaded without...

CVE-2025-57176

CVE-2025-57176 affects Siklu EtherHaul EH-8010EH-1200 devices (firmware 7.4.0–10.7.3). The rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location. Uploads use weak encryption (metadata only) with file contents in cleartext and no authentication or path valida...

CVE-2025-10267

NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files. If the attacker manages to bypass the file extension restrictions, they could upload a webshell and execute it on the server side...

CVE-2025-10267 NewType Infortech｜NUP Portal - Missing Authentication

NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files. If the attacker manages to bypass the file extension restrictions, they could upload a webshell and execute it on the server side...

PT-2025-37302

Name of the Vulnerable Software and Affected Versions: NUP Portal affected versions not specified Description: The NUP Portal application developed by NewType Infortech suffers from a missing authentication issue. This allows unauthenticated remote attackers to directly upload files to the system...

CVE-2025-9113 Doccure <= 1.4.8 - Unauthenticated Arbitrary File Upload

The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccuretempuploadtomedia' function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

CVE-2025-52546

E3 Site Supervisor Control firmware version 2.31F01 has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page...

CVE-2025-52544

E3 Site Supervisor Control firmware version 2.31F01 has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system...

CVE-2025-52546 Stored XSS by uploading a specially crafted floor plan file

E3 Site Supervisor Control firmware version 2.31F01 has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page...

CVE-2025-52544

CVE-2025-52544 affects Copeland/ E3 Site Supervisor Control firmware versions before 2.31F01. A floor plan feature permits an unauthenticated attacker to upload floor plan files, which can be used to read arbitrary files from the E3 file system. Documented impact indicates potential arbitrary fil...

CVE-2024-13342

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'addfilestoorder' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double...

CVE-2024-13984

QiAnXin TianQing Management Center affected versions up to 6.7.0.4130 contain a path traversal flaw in the rptsvr/upload endpoint. The filename in multipart form-data requests isn’t properly sanitized, enabling unauthenticated attackers to upload files to arbitrary locations on the server, potent...

PT-2025-34941 · Qi Anxin · Qianxin Tianqing Management Center

Name of the Vulnerable Software and Affected Versions: QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 Description: QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component. Unauthenticated...

📄 Pharmacy Product Management System 1.0 Cross Site Scripting

Pharmacy Product Management System version 1.0 suffers from a persistent cross site scripting vulnerability. Exploit Title: Pharmacy Product Management System - Persistent XSS Date: 25.08.2025 Exploit Author: Ömer Ahmet Yılmaz Vendor Homepage:...

CVE-2025-53120

A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration and web root directories, achieving remote code execution on the Unified PAM server...

CVE-2025-53120

CVE-2025-53120 concerns Securden Unified PAM. A path-traversal flaw in the unauthenticated file-upload feature lets an attacker craft arbitrary file names/paths to place binaries or scripts into the server’s configuration and web root directories, achieving remote code execution on the Unified PA...