CVE-2025-3917: Unrestricted Upload of File with Dangerous Type

The 百度站长SEO合集支持百度/神马/Bing/头条推送 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the downloadremoteimagetomedialibrary function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to upload arbitrary...

WordPress 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin <= 2.0.6 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by theviper17y in WordPress Plugin 百度站长SEO合集支持百度/神马/Bing/头条推送 versions = 2.0.6...

CVE-2025-4561

The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-4556

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2025-4317 TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegemgetlogourl function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary...

CVE-2025-4317 TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegemgetlogourl function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary...

CVE-2025-4317: Unrestricted Upload of File with Dangerous Type

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegemgetlogourl function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary...

WordPress TheGem plugin <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Theme TheGem versions = 5.10.3...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

82,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in TheGem WordPress Theme

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. On May 4th, 2025, we received a submission for an Arbitrary File Upload...

CVE-2025-4561

The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-4561

CVE-2025-4561 affects KingFor KFOX. Multiple sources confirm an Arbitrary File Upload vulnerability that allows remote attackers with regular privileges to upload and execute web shell backdoors, resulting in arbitrary code execution on the server. Root cause identified as improper handling of fi...

CVE-2025-4561 Kinfor KFOX - Arbitrary File Upload

The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-4556

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-4556 ZONG YU Okcat Parking Management Platform - Arbitrary File Upload

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2025-20678 · Unknown · Okcat Parking Management Platform

Name of the Vulnerable Software and Affected Versions: Okcat Parking Management Platform affected versions not specified Description: The web management interface of the Okcat Parking Management Platform has an Arbitrary File Upload issue, allowing unauthenticated remote attackers to upload and...

KingFor KFOX code issue vulnerabilities

KingFor KFOX is a domestically owned and controlled industrial-grade real-time operating system from China's KingFor Information KingFor, targeting the intelligent manufacturing and Internet of Things IoT sectors. KingFor KFOX suffers from a code issue vulnerability that originates from allowing...

CVE-2024-55466

The ThingsBoard IoT platform (Community, Cloud, and Professional editions) is vulnerable to an arbitrary file upload vulnerability in the Image Gallery feature (version 3.8.1 and below ). While some descriptions suggest arbitrary code execution, detailed research reveals the root cause is Stored ...

CVE-2024-55466: Improper Neutralization of Special Elements used in a Command

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...