CVE-2025-66254 Unauthenticated Arbitrary File Deletion (upgrade_contents.php)

Unauthenticated Arbitrary File Deletion upgradecontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter allows unauthenticated deletion of arbitrary...

PT-2025-48106

Name of the Vulnerable Software and Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30 through 7000 Description An unauthenticated attacker can delete arbitrary files. The deleteupgrade parameter within the /var/www/upgrade contents.php file allows for the...

EUVD-2025-198992

Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in the name and uploadDir parameters and saves the provided multipart file content without adequate validation or sanitization of...

CVE-2025-63228

The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /uploadfile.php endpoint. An attacker can exploit this by sending a crafted POST request with a malicious file e.g., a PHP webshell to the server. The uploade...

CVE-2025-63228

CVE-2025-63228 affects Mozart FM Transmitter web management interface, version WEBMOZZI-00287. The vulnerability is an unauthenticated file upload in the /upload_file.php endpoint. A crafted POST with a malicious file (for example a PHP webshell) is stored in /upload/, enabling remote code execut...

CVE-2025-63228

The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /uploadfile.php endpoint. An attacker can exploit this by sending a crafted POST request with a malicious file e.g., a PHP webshell to the server. The uploade...

Generex UPS Adapter CS141 Unrestricted Upload of File with Dangerous Type (CVE-2022-47186)

There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the upload directory. This plugin only works with Tenable.ot. Please visit...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 5.7.2 that stems from the upload handler not...

CVE-2025-11692

The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the...

EUVD-2002-0144

Malware in sbrugna...

EUVD-2020-23367

Malware in sbrugna...

EUVD-2025-23952

Malicious code in bioql PyPI...

EUVD-2025-32040

Malicious code in bioql PyPI...

CVE-2025-61189

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the we...

CVE-2024-13984 Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload

QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthenticated attackers to upload files to arbitrary locations on the server. The /rptsvr/upload endpoint fails to sanitize the filename paramete...

WukongCRM 安全漏洞

WukongCRM is a Customer Relationship Management CRM system from China Wukong Wukong. A security vulnerability exists in WukongCRM version 11.0, which originates in the file /adminFile/upload and leads to the disclosure of information via an error message...

CVE-2012-10050

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restartcirculationvalueswrite.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/1/ directory. Thes...

CVE-2025-54787

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID e.g. attachments. An...

CVE-2012-10050

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restartcirculationvalueswrite.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/1/ directory. Thes...

CVE-2012-10050 CuteFlow <= 2.11.2 Arbitrary File Upload RCE

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restartcirculationvalueswrite.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/1/ directory. Thes...