CVE-2025-60219 WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.This issue affects WooCommerce Designer Pro: from n/a through = 1.9.24...

CVE-2025-60219

The CVE-2025-60219 entry concerns HaruTheme WooCommerce Designer Pro (versions up to 1.9.24). The vulnerability is an Unrestricted Upload of File with Dangerous Type, enabling uploading of a web shell to the web server. Root cause centers on permissive file-type handling in the plugin’s upload me...

CVE-2025-60219 WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.This issue affects WooCommerce Designer Pro: from n/a through = 1.9.24...

CVE-2025-1862 Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By...

CVE-2025-1862

The CVE-2025-1862 entry concerns WSO2 products with an arbitrary file upload vulnerability in the BPEL uploader SOAP service endpoint caused by improper validation of user-supplied filenames. The flaw allows an authenticated attacker (with administrative privileges) to upload files to a server-co...

CVE-2025-1862 Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By...

CVE-2025-10747

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2025-10747 WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2025-10747 WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2025-10747

CVE-2025-10747 - WP-DownloadManager (WordPress) is validated by Wordfence as an authenticated, high-severity vulnerability: missing file-type validation in download-add.php allows an Administrator+ attacker to upload arbitrary files on the server, potentially enabling remote code execution. Affec...

CVE-2025-10747: Unrestricted Upload of File with Dangerous Type

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

WSO2 Enterprise Integrator 安全漏洞

WSO2 Enterprise Integrator is an open source hybrid integration platform from WSO2, Inc. in the United States. The platform supports communication between multiple applications. A security vulnerability exists in WSO2 Enterprise Integrator that stems from the BPEL uploader SOAP service endpoint n...

CVE-2025-1862: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By...

WordPress WP-DownloadManager plugin <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by n4ur15 in WordPress Plugin WP-DownloadManager versions = 1.68.11...

CVE-2025-10147

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'moveasoriginalfile' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2025-10412

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO Premium plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'unicpouploadfile' function in all versions up to, and including, 4.9.55. This makes it possible for...

Exploit for CVE-2025-57176

CVE-2025-57176 CVE-2025-57176 -...

WordPress Advanced Settings Plugin <= 3.1.1 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by R1sky in WordPress Plugin Advanced Settings versions = 3.1.1...

Arbitrary File Upload

xml2rfc is vulnerable to Arbitrary File Upload. The vulnerability is due to improper input sanitization because an attacker can inject a malicious element into the XML used to generate the PDF, causing the generator to read and include arbitrary filesystem files...

CVE-2025-10412

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO Premium plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'unicpouploadfile' function in all versions up to, and including, 4.9.55. This makes it possible for...