SAP NetWeaver Visual Composer Metadata Uploader 代码问题漏洞

SAP NetWeaver Visual Composer Metadata Uploader is a tool for modeling assistance from SAP. A file upload vulnerability exists in SAP NetWeaver Visual Composer Metadata Uploader. The vulnerability is due to an unauthenticated agent uploading potentially malicious executable binaries because the...

Malicious code in anton-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3378 Malicious code in anton-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3329 Malicious code in @sporta-technology/d11-web-components.file-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @sporta-technology/d11-web-components.file-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-32370

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not...

CVE-2025-32370

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not...

Cross-site Scripting (XSS)

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Cross-site Scripting XSS in MultiFileUploader. An attacker can inject malicious scripts that are stored when uploaded as a multi-fil...

CVE-2025-1662

CVE-2025-1662 is an SSRF flaw in the WordPress plugin URL Media Uploader (

CVE-2025-1662 URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'urlmediauploaderurlupload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrar...

CVE-2025-1662 URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'urlmediauploaderurlupload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrar...

PT-2025-9081 · WordPress · Url Media Uploader

Name of the Vulnerable Software and Affected Versions: URL Media Uploader plugin for WordPress versions prior to 1.1.0, or more specifically, version 1.0.0 and earlier Description: The issue allows authenticated attackers with author-level access and above to perform Server-Side Request Forgery v...

WordPress plugin URL Media Uploader 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A code issue vulnerability...

WordPress URL Media Uploader plugin <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding vulnerability

Authenticated Author+ Server-Side Request Forgery via DNS Rebinding vulnerability discovered by ch4r0n in WordPress Plugin URL Media Uploader versions = 1.0.0...

Arbitrary File Upload

Overview streamlit is a The fastest way to build data apps in Python Affected versions of this package are vulnerable to Arbitrary File Upload in the fileuploader.py widget, which does not enforce uploaded file type restrictions on the server side, even if they are set in the client. Remediation...

CVE-2024-57082

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@rpldy/uploader prototype pollution

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@rpldy/chunked-uploady (>=1.6.1-rc.0, <=1.9.0), @rpldy/retry-hooks (>=1.6.1-rc.0, <=1.9.0) +8 more potentially affected by CVE-2024-57082 via @rpldy/uploader (>=1.6.1, <=1.9.0-rc.2)

@rpldy/uploader NPM version =1.6.1, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.9.0 Source cves: CVE-2024-57082 Source advisory: OSV:GHSA-PC47-G7GV-4GPW...

GHSA-PC47-G7GV-4GPW @rpldy/uploader prototype pollution

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57082

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...