sms 安全漏洞

sms is a student grade management system by Jeffrey Personal Developer. A security vulnerability exists in version 1.0 of sms, which stems from the /api/sms/upload/headImg endpoint that allows the uploading of arbitrary files, which could lead to an arbitrary file upload attack...

CVE-2025-56263

The by-night sms student grade management system (version 1.0 ) is vulnerable to an Arbitrary File Upload vulnerability via the /api/sms/upload/headImg endpoint. The root cause is that the application fails to restrict the type and size of files during the upload process, allowing users to upload...

SourceCodester Pet Grooming Management Software 代码问题漏洞

SourceCodester Pet Grooming Management Software is a SourceCodester open source pet grooming management system. A code issue vulnerability exists in version 1.0 of SourceCodester Pet Grooming Management Software, which stems from an incorrect manipulation of the parameter websiteimage in the file...

1000 Projects Online Student Project Report 代码问题漏洞

1000 Projects Online Student Project Report is an open source online student project reporting system from 1000 Projects. A code issue vulnerability exists in version 1.0 of 1000 Projects Online Student Project Report, which stems from an incorrect manipulation of the parameter newimage in the fi...

Campcodes Online Job Finder System 安全漏洞

CampCodes Online Job Finder System is an online job finder system from CampCodes, Inc. A security vulnerability exists in version 1.0 of the Campcodes Online Job Finder System, which stems from an incorrect manipulation of the parameter picture in the file /eris/applicationform.php, which could...

fcba_zzm ics-park 代码问题漏洞

fcbazzm ics-park is an intelligent park management system from fcbazzm. A code issue vulnerability exists in version 2.0 of fcbazzm ics-park, which stems from the incorrect manipulation of the parameter File in the file FileUploadUtils.java, and could lead to arbitrary file uploads...

WordPress Responsive Filterable Portfolio plugin Arbitrary File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Responsive Filterable Portfolio plugin has an arbitrary file upload vulnerability that stems from a lack of file type validation in the HdnMediaSelectionimage fiel...

CVE-2025-8889

The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2025-42922

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-58745

WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary file upload vulnerability. The WeGIA only check MIME types for Excel files at endpoint /html/socio/sistema/controller/controlaxlsx.php, which can be bypassed by using magic byt...

CVE-2025-9112

The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccuretempfileuploader' function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to...

CVE-2025-10001

CVE-2025-10001 concerns the WordPress plugin “Import any XML, CSV or Excel File to WordPress”. The root cause is missing file-type validation in the import functionality, affecting all versions up to and including 3.9.3. The vulnerability allows an authenticated attacker with Administrator-level ...

CVE-2025-10049

CVE-2025-10049 affects the WordPress plugin “Responsive Filterable Portfolio” (versions

CVE-2025-10049 Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload

The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelectionimage field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level acce...

CVE-2025-56265

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file...

CVE-2025-10049: Unrestricted Upload of File with Dangerous Type

The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelectionimage field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level acce...

CVE-2025-10001: Unrestricted Upload of File with Dangerous Type

The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level...

PT-2025-37007

Name of the Vulnerable Software and Affected Versions: Responsive Filterable Portfolio plugin for WordPress versions through 1.0.24 Description: The plugin is susceptible to arbitrary file uploads due to missing file type validation via the HdnMediaSelection image field. This allows authenticated...

WordPress Responsive Filterable Portfolio plugin <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Responsive Filterable Portfolio versions = 1.0.24...

WordPress WP All Import plugin <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload vulnerability

Authenticated Admin+ Limited Unsafe File Upload vulnerability discovered by Nguyen Quang Truong Roll in WordPress Plugin WP All Import versions = 3.9.3...