CVE-2025-7065

The CVE-2025-7065 entry involves PAD CMS photo upload where a client-controlled permission-check parameter allows unauthenticated remote attackers to upload files of any type/extension, potentially leading to Remote Code Execution. Affected are all three templates: www, bip, and ww+bip. The under...

CVE-2025-7065 Remote Code Execution via Unrestricted File Upload in PAD CMS

Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www,...

CVE-2025-7065 Remote Code Execution via Unrestricted File Upload in PAD CMS

Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www,...

CVE-2025-7063

CVE-2025-7063 affects PAD CMS file upload: due to a client-controlled permission check parameter, an unauthenticated attacker can upload arbitrary files, which can then be executed to achieve Remote Code Execution. Impacts all three templates (www, bip, ww+bip). The product is End-Of-Life and pat...

CVE-2025-7063 Remote Code Execution via Unrestricted File Upload in PAD CMS

Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, b...

CVE-2025-7063 Remote Code Execution via Unrestricted File Upload in PAD CMS

Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, b...

CVE-2025-10544

Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system...

CVE-2025-10544

CVE-2025-10544 concerns AvePoint products (DocAve <= 6.13.2, Perimeter <= 1.12.3, Compliance Guardian

CVE-2025-10544 Unrestricted uploading of dangerous file types to AvePoint products

Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system...

CVE-2025-10544 Unrestricted uploading of dangerous file types to AvePoint products

Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system...

CVE-2025-60219

Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.This issue affects WooCommerce Designer Pro: from n/a through = 1.9.24...

Fortra FileCatalyst 5.1.6 < 5.2.0 build 130 Unrestricted File Upload (fi-2025-010)

The version of Fortra FileCatalyst Workflow running on the remote host is 5.1.6 prior to 5.2.0 build 130. It is, therefore, is affected by a unrestricted file upload vulnerability as referenced in fi-2025-010 advisory. - Improper Access Control issue in the Workflow component of Fortra's...

CVE-2025-9846

Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection.This issue affects Inka.Net: before 6.7.1...

CVE-2025-9846

Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1...

CVE-2025-9846

CVE-2025-9846 describes an Unrestricted Upload of File with Dangerous Type in TalentSys Inka.Net (pre-6.7.1) that enables Command Injection. Multiple sources (NVD/Red Hat/CVE list) corroborate: affected product Inka.Net before 6.7.1; CVSS v3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)...

CVE-2025-9846 Unrestricted File Upload in TaletSys Inka.Net

Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1...

CVE-2025-9846 Unrestricted File Upload in TaletSys Inka.Net

Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1...

CVE-2025-10615

A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used...

PT-2025-38263

Name of the Vulnerable Software and Affected Versions: itsourcecode E-Commerce Website version 1.0 Description: A vulnerability exists in itsourcecode E-Commerce Website 1.0, impacting an unknown function within the /admin/products.php file. This allows for unrestricted file upload, and the attac...

CVE-2025-10425

A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/studentcontroller.php. Such manipulation of the argument newimage leads to unrestricted upload. The attack m...