PT-2025-31991 · Glossword · Glossword

Name of the Vulnerable Software and Affected Versions: Glossword versions 1.8.8 through 1.8.12 Description: Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gw admin.php...

CVE-2025-6207: Unrestricted Upload of File with Dangerous Type

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

WordPress plugin WP Import Export Lite 代码问题漏洞

WordPress WP Import Export Lite plugin is the official WordPress recommended import and export plugin that supports batch processing of site data, including posts, pages, taxonomies, comments and user data, etc. It supports a variety of file formats such as CSV, JSON, XML and so on. WordPress WP...

WordPress WP Import Export Lite plugin <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin WP Import Export Lite versions = 3.9.29...

WordPress WP Import Export Lite plugin <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin WP Import Export Lite versions = 3.9.28...

CVE-2025-52239

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file...

CVE-2013-10054 LibrettoCMS File Manager Arbitrary File Upload

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 and possibly earlier contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails ...

CVE-2013-10054

CVE-2013-10054 affects LibrettoCMS (1.1.7 and possibly earlier) via the File Manager plugin. The upload handler at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php does not properly validate file extensions, allowing unauthenticated upload of files that can be renamed to executable .php s...

CVE-2013-10054 LibrettoCMS File Manager Arbitrary File Upload

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 and possibly earlier contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails ...

WordPress Shopo <= 1.1.4 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Shopo versions = 1.1.4...

Arbitrary File Upload

simogeo/filemanager is vulnerable to Arbitrary File Upload. The vulnerability is due to improper file type validation due to insufficient checks in the isallowedfiletype function, allowing attackers to upload crafted PHP files and execute arbitrary code...

WordPress Shopo Theme <= 1.1.4 is vulnerable to Arbitrary File Upload

Software Shopo Type Theme Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-31048 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 148bf5acafb9 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-52239

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file...

CVE-2025-52239

The ZKEACMS content management system, version 4.1 , is impacted by an arbitrary file upload vulnerability (CWE-434). Attackers can exploit this flaw by uploading a crafted file to achieve arbitrary code execution . The vulnerability is rated as CRITICAL with a CVSS v3.1 score of 9.8 , indicating...

CVE-2025-52239

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file...

CVE-2025-52239: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file...

CVE-2013-10054: Unrestricted Upload of File with Dangerous Type

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 and possibly earlier contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails ...

CVE-2025-54962

/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files such as .html or .svg, and these are then publicly accessible under the /static URI...

CVE-2025-52239

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file...

Xerte Online Toolkits Arbitrary File Upload - Import Language

This module exploits an authentication bypass allowing arbitrary file upload in versions 3.14 and earlier to upload and execute a shell. Module Options msf use exploit/multi/http/xerte/unauthenticatedimportlanguage msf undefinedunauthenticatedimportlanguage show actions ...actions... msf...