CVE-2025-8526

A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation of the argument File leads to...

CVE-2025-8526 Exrick xboot UploadController.java upload unrestricted upload

A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation of the argument File leads to...

CVE-2025-8504

A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-8344

A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument filename leads to unrestricted upload. It is...

CVE-2013-10047

CVE-2013-10047 affects MiniWeb HTTP Server up to Build 300. An unrestricted file upload with path traversal lets unauthenticated remote attackers drop a .exe in System32 and a .mof in the WMI directory, enabling payload execution with SYSTEM privileges via WMI on Windows versions before Vista. Mu...

CVE-2025-44139

Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=uploadzip...

CVE-2025-44139

Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=uploadzip...

PT-2025-31684 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: MiniWeb HTTP Server versions prior to and including Build 300 Description: An unrestricted file upload vulnerability exists that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the uplo...

CVE-2025-44139

Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=uploadzip...

CVE-2014-125126

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header access=3 with HTTP requests. The application’s upload mechanism fails to restrict file types and does not...

CVE-2013-10034

An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and...

CVE-2014-125126 Simple E-Document Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header access=3 with HTTP requests. The application’s upload mechanism fails to restrict file types and does not...

CVE-2013-10034

CVE-2013-10034 affects Kaseya KServer versions prior to 6.3.0.2. The vulnerability is an unrestricted file upload via the vulnerable uploadImage.asp endpoint, allowing unauthenticated upload of files to arbitrary paths through a crafted filename in a multipart/form-data POST. A file with an .asp ...

CVE-2025-54757

Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser...

CVE-2025-8344

CVE-2025-8344 : OpenViGlet Shio (versions up to 0.3.8) has a flaw in the ShStaticFileAPI.shStaticFileUpload function. Malicious manipulation of the filename argument allows unrestricted file uploads, enabling a remote attack. Publicly disclosed exploits/ PoC exist according to the references. A p...

Samsung MagicINFO 9 Server MagicInfoWebAuthorClient Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung MagicINFO 9 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MagicInfoWebAuthorClient app. The issue results from the lack of proper...

PT-2025-31055 · 299Ko Cms · 299Ko Cms

Name of the Vulnerable Software and Affected Versions: 299Ko CMS version 2.0.0 Description: A critical vulnerability exists in the File Management component of 299Ko CMS 2.0.0. The issue involves unrestricted file upload through manipulation of the /admin/filemanager/view file. The attack can be...

Samsung MagicINFO 9 Server filenameHasExecutableType Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung MagicINFO 9 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the filenameHasExecutableType method. The issue results...

Samsung MagicINFO 9 Server getFontFileFromMagicInfoServer Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung MagicINFO 9 Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementatio...

PT-2025-30945 · Code Projects · Voting System 1.0

Name of the Vulnerable Software and Affected Versions: code-projects Voting System version 1.0 Description: A critical vulnerability exists in code-projects Voting System 1.0, related to unrestricted file upload. The issue affects an unknown functionality within the /admin/candidates add.php file...