SourceCodester Client Database Management System security vulnerabilities

SourceCodester Client Database Management System is a SourceCodester open source client database management system. A security vulnerability exists in SourceCodester Client Database Management System version 1.0, which originates from a misbehavior of the parameter uploadedfilecancelled in...

CVE-2025-46191

The SourceCodester Client Database Management System version 1.0 is vulnerable to Arbitrary File Upload in the user_payment_update.php script. The root cause is a lack of authentication, file extension checks, and MIME type validation when processing the uploaded_file_cancelled field. This allows...

CVE-2025-46193

SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in userproposalupdateorder.php...

PT-2025-20483 · Unknown · Envolve Plugin

Name of the Vulnerable Software and Affected Versions: Envolve Plugin versions up to, and including, 1.0 Description: The issue is related to arbitrary file uploads due to missing file type validation in the zetra languageUpload and zetra fontsUpload functions. This allows unauthenticated attacke...

CVE-2025-46191

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

CVE-2025-46191

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

CVE-2025-46193

SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in userproposalupdateorder.php...

CVE-2024-11617: Unrestricted Upload of File with Dangerous Type

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetralanguageUpload' and 'zetrafontsUpload' functions in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary fil...

CVE-2025-46191: Improper Control of Generation of Code

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

CVE-2025-46193: Unrestricted Upload of File with Dangerous Type

SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in userproposalupdateorder.php...

CVE-2025-4403: Unrestricted Upload of File with Dangerous Type

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supportedtype string and the uploaded filename without enforcing real extension or MIME checks within th...

WordPress Envolve Plugin plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file vulnerability

Unauthenticated Arbitrary File Upload via languagefile and fontsfile vulnerability discovered by Foxyyy in WordPress Plugin Envolve Plugin versions = 1.0...

WordPress 1 Click WordPress Migration Plugin plugin <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Kate Kligman Sunsword in WordPress Plugin 1 Click WordPress Migration versions = 2.2...

WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin ELEX WordPress HelpDesk & Customer Ticketing System versions = 3.2.9...

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'startrestore' function in all versions up to, and including, 2.2. This makes it possible for...

Exploit for Unrestricted Upload of File with Dangerous Type in Themefic Instantio

Instantio - Wordpress Plugin 1: lo: mtu 65536 qdisc noqueue s...

CVE-2025-20188

A vulnerability in the Out-of-Band Access Point AP Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. Th...

CVE-2025-47550 WordPress Instantio <= 3.3.16 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio allows Upload a Web Shell to a Web Server. This issue affects Instantio: from n/a through 3.3.16...

CVE-2025-47549 WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through = 4.6.10...

CVE-2025-47549 WordPress BEAF <= 4.6.10 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF allows Upload a Web Shell to a Web Server. This issue affects BEAF: from n/a through 4.6.10...