CVE-2013-10034 Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and...

CVE-2013-10034 Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and...

CVE-2013-10038 FlashChat Arbitrary File Upload RCE

An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed...

CVE-2013-10038

CVE-2013-10038 applies to FlashChat versions 6.0.2 and 6.0.4–6.0.8. A flaw in the upload.php endpoint fails to validate file types and authentication, enabling an unauthenticated attacker to upload a PHP script and potentially achieve arbitrary code execution on the web server user. The issue is ...

CVE-2013-10038 FlashChat Arbitrary File Upload RCE

An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed...

CVE-2013-10040

CVE-2013-10040 affects ClipBucket 2.6 and earlier. Affected component is the ofc_upload_image.php script under /admin_area/charts/ofc-library/, which allows unauthenticated users to upload arbitrary files (including PHP), with access to the uploaded file via a predictable path and resulting in re...

CVE-2013-10040 ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE

ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofcuploadimage.php script located at /adminarea/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file...

WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by theviper17 in WordPress Plugin StoreKeeper for WooCommerce versions = 14.4.4...

CVE-2025-7847

The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restsimpleFileUpload function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on...

CVE-2025-7847 AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload

The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restsimpleFileUpload function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on...

Kaseya KServer 安全漏洞

Kaseya KServer is a central server node for a management system from Kaseya Corporation, USA. A security vulnerability exists in Kaseya KServer versions prior to 6.3.0.2, which stems from an unauthenticated and uncleaned uploadImage.asp endpoint that could lead to arbitrary file uploads and remot...

TUFaT FlashChat 安全漏洞

TUFaT FlashChat is an online chat system script from TUFaT Inc. A security vulnerability exists in TUFaT FlashChat version 6.0.2 and versions 6.0.4 through 6.0.8, which stems from a failure to validate file types and authentication in the upload.php endpoint, which could lead to arbitrary file...

CVE-2025-7847: Unrestricted Upload of File with Dangerous Type

The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restsimpleFileUpload function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on...

CVE-2013-10038: Unrestricted Upload of File with Dangerous Type

An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed...

WordPress AI Engine plugin 2.9.3-2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by ISMAILSHADOW in WordPress Plugin AI Engine versions 2.9.3-2.9.4...

100,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in AI Engine WordPress Plugin

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters!📢 🌞 Spring into Summer with Wordfence! Now through August 4, 2025, earn 2X bounty rewards forall in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per...

CVE-2025-8323 Ventem｜e-School - Arbitrary File Upload

The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-8323 Ventem｜e-School - Arbitrary File Upload

The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-8323

The CVE-2025-8323 entry concerns Ventem’s e-School platform, where an Arbitrary File Upload vulnerability allows unauthenticated remote attackers to upload and execute a web shell, enabling arbitrary code execution on the server. The vulnerability is linked to a flaw in the file-upload flow, with...

PT-2025-31375 · Ventem · E-School

Name of the Vulnerable Software and Affected Versions: e-School from Ventem affected versions not specified Description: The e-School from Ventem has an Arbitrary File Upload vulnerability. This allows unauthenticated remote attackers to upload and execute web shell backdoors, enabling arbitrary...