17449 matches found
CVE-2025-3054
The WP User Frontend Pro plugin for WordPress (versions up to and including 4.1.3 ) is vulnerable to arbitrary file uploads due to a lack of file type validation in the upload_files() function. This flaw allows authenticated attackers with Subscriber-level access or higher to upload arbitrary fil...
WordPress Store Locator WordPress plugin <= 1.5.2 - Arbitrary File Upload Vulnerability
Arbitrary File Upload Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin Store Locator WordPress versions = 1.5.2...
CVE-2025-45855
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
WordPress plugin WP User Frontend Pro 代码问题漏洞
WordPress WP User Frontend Pro plugin is a WordPress front-end user center plugin that provides powerful front-end administration features. WordPress WP User Frontend Pro plugin has a code issue vulnerability, the vulnerability stems from the lack of file type validation in the uploadfiles...
CVE-2025-3054: Unrestricted Upload of File with Dangerous Type
The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...
WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...
CVE-2025-20130: Improper Access Control
A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through a manipulated API request. An attacker can upload unauthorized files by crafting a request that bypasses the configured file extension checks. Remediation Upgrade Umbraco.Cms.Core to version 15.4.2,...
CVE-2025-45854
/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams...
GHSA-5GR5-VMMR-82G6 Erupt Unrestricted Upload of File with Dangerous Type vulnerability
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the /upload/GoodsCategory/image component. An attacker can cause code execution by uploading a malicious file. Remediation There is no fixed version for xyz.erupt:erupt. References - GitHub Gist - Vulnerabl...
CVE-2025-45855
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2025-45854
JEHC-BPM contains a Remote Code Execution vulnerability in the /server/executeExec endpoint. The issue affects JEHC-BPM
PT-2025-23615 · Erupt · Erupt
Name of the Vulnerable Software and Affected Versions: erupt version 1.12.19 Description: The issue is related to an arbitrary file upload vulnerability in the /upload/GoodsCategory/image component, which allows attackers to execute arbitrary code by uploading a crafted file. Recommendations: For...
JEHC-BPM 安全漏洞
JEHC-BPM is a BPM open source platform for jehc individual developers. A security vulnerability exists in JEHC-BPM v2.0.1, which originates from an arbitrary file upload in the /server/executeExec component and could lead to arbitrary code execution...
CVE-2025-45855
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2025-45854
/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams...
CVE-2025-45855
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
