CVE-2025-13516: Unrestricted Upload of File with Dangerous Type

The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's savefile function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessibl...

CVE-2025-11087: Cross-Site Request Forgery (CSRF)

The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This makes it possib...

CVE-2021-36532: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php...

CVE-2021-36532

Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php...

PT-2022-20324

Name of the Vulnerable Software and Affected Versions elitecms version 1.0.1 Description The issue allows for Arbitrary code execution via the "admin/manage uploads.php" endpoint. Recommendations For elitecms version 1.0.1, as a temporary workaround, consider disabling access to the "admin/manage...

PT-2022-18772

Name of the Vulnerable Software and Affected Versions Atom.CMS version 2.0 Description The issue is related to SQL Injection via the Atom.CMS admin uploads.php file. Recommendations For Atom.CMS version 2.0, as a temporary workaround, consider restricting access to the Atom.CMS admin uploads.php...

CVE-2022-0889: Improper Neutralization of Input During Web Page Generation

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the /includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web script...

WordPress plugin Ninja Forms - File Uploads Extension 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is an application plugin for WordPress. WordPress Ninja Forms - File Uploads Extension Plugin...

CVE-2022-0888: Unrestricted Upload of File with Dangerous Type

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious file...

CVE-2022-25487

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

Remote code execution

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

CVE-2022-25487

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

CVE-2022-25487

Atom CMS v2.0 contains a remote code execution (RCE) vulnerability exploitable via /admin/uploads.php. The Nuclei template and CIRCL/CVE records confirm the issue stems from improper handling in the uploads path, enabling arbitrary code execution on the affected system. Impact is described as ful...

CVE-2022-25487: Unrestricted Upload of File with Dangerous Type

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

PT-2022-17322

Name of the Vulnerable Software and Affected Versions Atom CMS version 2.0 Description A remote code execution RCE issue was discovered in Atom CMS via the /admin/uploads.php endpoint. This allows for potential code execution on the server. Recommendations For Atom CMS version 2.0, as a temporary...

PT-2022-12564

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description The issue concerns Insecure Permissions, specifically via the manage uploads.php file. This allows for potential unauthorized access or modifications. Recommendations For eliteCMS version 1.0, consider...

CVE-2020-25406

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

CVE-2020-25406

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

CVE-2020-25406

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

CVE-2020-25406: Unrestricted Upload of File with Dangerous Type

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...