CVE-2025-40599: Unrestricted Upload of File with Dangerous Type

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution...

SonicWALL SMA 代码问题漏洞

SonicWALL SMA is a security protection product for enterprise management security access applications from SonicWALL USA. A code issue vulnerability exists in the SonicWall SMA 100 that originates from an arbitrary file upload after authentication and could lead to remote code execution...

Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access

Cisco on Monday updated its advisory of a set of recently disclosed security flaws in Identity Services Engine ISE and ISE Passive Identity Connector ISE-PIC to acknowledge active exploitation. "In July 2025, the Cisco PSIRT Product Security Incident Response Team, became aware of attempted...

WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin ReachShip WooCommerce Multi-Carrier & Conditional Shipping versions = 4.3.1...

CVE-2012-10020

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

CVE-2012-10020 FoxyPress <= 0.4.2.1 - Arbitrary File Upload

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

CVE-2012-10020 FoxyPress <= 0.4.2.1 - Arbitrary File Upload

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

CVE-2015-10137 Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload

The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadfile' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2015-10137 Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload

The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadfile' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

PT-2025-30372

Name of the Vulnerable Software and Affected Versions FoxyPress versions up to 0.4.2.1 Description The FoxyPress plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation in the uploadify.php file. This allows unauthenticated attackers to upload...

CVE-2015-10140: Missing Authorization

The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files...

CVE-2015-10137: Unrestricted Upload of File with Dangerous Type

The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadfile' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

WordPress FoxyPress plugin <= 0.4.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin Foxypress versions 0.4.2.2...

GHSA-96C2-H667-9FXP nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to: • Missing authentication middleware Nova and Nova.Auth on the...

Arbitrary File Upload

Overview marshmallow/nova-tiptap is a Laravel Nova tiptap editor field. Affected versions of this package are vulnerable to Arbitrary File Upload via the /nova-tiptap/api/file endpoint, which lacks authentication and file validation. An attacker can upload arbitrary files, including executable or...

CVE-2025-54082

marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...

CVE-2016-15043

The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

CVE-2025-7917

WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-7917

CVE-2025-7917 concerns the WinMatrix3 Web package from Simopro Technology. The connected sources describe an Arbitrary File Upload vulnerability in WinMatrix3 Web, enabling remote attackers with administrator privileges to upload and execute web shell backdoors, resulting in arbitrary code execut...

CVE-2025-7917 Simopro Technology｜WinMatrix3 Web package - Arbitrary File Upload

WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...