CVE-2012-10036 Project Pier <= 0.8.8 Arbitrary File Upload RCE

Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/uploadfile.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. T...

CVE-2013-10066

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint usersadd.php that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP...

CVE-2014-125113 Dell/Quest KACE K1000 Unauthenticated File Upload RCE

An unrestricted file upload vulnerability exists in Dell acquired by Quest KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547 in the downloadagent.php endpoint. An attacker can upload arbitrary PHP files to a temporary web-accessible...

PT-2025-31979

Name of the Vulnerable Software and Affected Versions WP-Property versions prior to 1.36.0 Description The WP-Property plugin for WordPress through version 1.35.0 contains a file upload issue in the uploadify.php script. A remote attacker can upload arbitrary PHP files to a temporary directory...

WordPress StoryChief Plugin Unauthenticated RCE

This module exploits an unauthenticated arbitrary file upload vulnerability in the StoryChief WordPress plugin use exploit/multi/http/wp/pluginstorycheffileupload msf undefinedpluginstorycheffileupload show actions ...actions... msf undefinedpluginstorycheffileupload set ACTION msf...

Exploit for CVE-2025-5394

CVE-2025-5394 – WordPress Alone Theme = 7.8.3 - Unauthenticat...

CVE-2025-7437 Ebook Store <= 5.8012 - Unauthenticated Arbitrary File Upload

The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebookstoresaveform function in all versions up to, and including, 5.8012. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to: • Missing authentication middleware Nova and Nova.Auth on the...

CVE-2025-54082

CVE-2025-54082 affects marshmallow-packages/nova-tiptap (Laravel Nova tiptap editor). Prior to version 5.7.0, a vulnerability on the /nova-tiptap/api/file endpoint allowed unauthenticated uploads of arbitrary files to configured disks due to missing authentication middleware and lack of file vali...

Exploit for CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RC...

PT-2025-29892 · Lilin · Lilin Digital Video Recorder

Name of the Vulnerable Software and Affected Versions: LILIN Digital Video Recorder DVR versions prior to 2.0b60 20200207 Description: An unauthenticated arbitrary file read issue exists in LILIN Digital Video Recorder DVR devices. This allows attackers to read sensitive configuration files, such...

CVE-2025-7360

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handlefilesupload function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-7340

The CVE-2025-7340 entry concerns the WordPress plugin HT Contact Form Widget for Elementor/Page Builder/Gutenberg Blocks (versions up to and including 2.2.1). The root cause is missing server-side file type validation in temp_fileUpload(), allowing unauthenticated users to trigger an upload via t...

WordPress Alone theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability discovered by Thái An in WordPress Theme Alone versions = 7.8.2...

CVE-2024-26291

An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges root/NTAUTHORITY SYSTEM by default attackers are ab...

CVE-2020-36849 AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload

The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to...

CVE-2025-34046

An unauthenticated file upload vulnerability exists in the Fanwei E-Office = v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters uploadType=eofficelogo or...

CVE-2025-34046

An unauthenticated file upload vulnerability exists in the Fanwei E-Office = v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters uploadType=eofficelogo or...

CVE-2025-34046 Fanwei E-Office Unauthenticated File Upload

An unauthenticated file upload vulnerability exists in the Fanwei E-Office = v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters uploadType=eofficelogo or...

CVE-2025-30131

The CVE-2025-30131 entry concerns IROAD Dashcam FX2 devices with an unauthenticated file-upload endpoint that can be exploited to run commands via a CGI-based webshell. The underlying issue allows an attacker to execute commands with root privileges and gain full control of the device. In additio...