17374 matches found
CVE-2025-12352 Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...
CVE-2025-12352 Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...
WordPress Gravity Forms plugin <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image' vulnerability
Unauthenticated Arbitrary File Upload via 'copypostimage' vulnerability discovered by Talal Nasraddeen in WordPress Plugin Gravity Forms versions = 2.9.20...
CVE-2025-34299: Unrestricted Upload of File with Dangerous Type
Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious SFTP server...
CVE-2025-12352: Unrestricted Upload of File with Dangerous Type
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...
WordPress plugin Gravity Forms 代码问题漏洞
WordPress Gravity Forms plugin is a professional forms plugin for the WordPress platform, mainly used to create and manage various interactive forms, supporting data collection, payment processing, workflow automation and other features. WordPress Gravity Forms plugin has an arbitrary file upload...
CVE-2025-64176 ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176 ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176 ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip...
CVE-2025-64176
ThinkDashboard versions ≤ 0.6.7 are affected by an Arbitrary File Upload vulnerability in the Backup Import feature. An attacker can upload any file to the /data directory by selecting a ZIP for backup import, bypassing client-side file-type verification, potentially leading to stored XSS or malw...
CVE-2025-20354
A vulnerability in the Java Remote Method Invocation RMI process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system. This vulnerability is due to improper authentication mechanis...
CVE-2025-20375
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by uploading a...
CVE-2025-6327 WordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server.This issue affects King Addons for Elementor: from n/a through = 51.1.36...
CVE-2025-6327 WordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server.This issue affects King Addons for Elementor: from n/a through = 51.1.36...
CVE-2025-62065
CVE-2025-62065 : Unrestricted Upload of File with Dangerous Type in WordPress plugin RTMKit (rometheme-for-elementor), affecting RTMKit versions from n/a through 1.6.5. CVSS v3.1 base score 9.9 (CRITICAL) with network attack vector, low attack complexity, and no user interaction. The root cause i...
CVE-2025-62065 WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through = 1.6.5...
CVE-2025-62065 WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through = 1.6.5...
Exploit for CVE-2025-12673
Flex QR Code Generator ' shell.php curl -X POST "https://vic...
CVE-2025-62047 WordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through 1.3.0...
CVE-2025-62047
CVE-2025-62047 concerns WordPress Case Addons (< 1.3.0) where an Unrestricted Upload of File with Dangerous Type exists in the Case Addons plugin. The CNVD/Red Hat/NVD entries confirm the issue affects Case Addons and describe a path to remote code execution via arbitrary file uploads. The Wor...