PT-2026-95748

Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application...

CVE-2025-9173

CVE-2025-9173 is tied to Emlog Pro up to 2.5.18. The issue stems from improper handling of file uploads in /admin/media.php?action=upload&sid=0, where manipulation of the File argument can enable an unrestricted upload. Remote exploitation is possible per sources, with a publicly available exploi...

CVE-2024-55417

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server...

Voyager 安全漏洞

Voyager is an application by David Borland, an individual developer. A security vulnerability exists in Voyager version 1.8.0 and earlier, which stems from the ease of bypassing file type validation when an authenticated user uploads a file via /admin/media/upload...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload at the /admin/media/upload, which checks file types in the upload function. An authenticated user with the browsemedia privilege can provide a file spoofing one of the allowedMimeTypes, that contains malicious code...

GHSA-7F84-9CQF-G4J9 Camaleon CMS vulnerable to Stored Cross-site Scripting

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false...

Cross-site Scripting (XSS)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the profile image in the User settings section can be run in the update or in the uploa...

ZKEACMS 代码问题漏洞

ZKEACMS is an open source visually designed, WYSIWYG content management system. version 3.2.0 of ZKEACMS contains a security vulnerability that stems from an arbitrary file upload vulnerability in the application's "/admin/media/upload", which could be exploited to execute arbitrary code via a...

PT-2021-10527

Name of the Vulnerable Software and Affected Versions: ZKEACMS version 3.2.0 Description: An arbitrary file upload issue in the "/admin/media/upload" API endpoint allows attackers to execute arbitrary code via a crafted HTML file. Recommendations: For ZKEACMS version 3.2.0, consider disabling the...

CVE-2020-20670: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTML file...

CVE-2019-17536

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/mediaupload and fm/move...

PT-2019-15194

Name of the Vulnerable Software and Affected Versions Gila CMS versions prior to 1.11.5 Description The issue allows an attacker to upload a file with a dangerous type via the moveAction function in core/controllers/fm.php. This can be achieved by using the admin/media upload and fm/move endpoint...