CVE-2025-25784

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25791

An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25783

An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25790: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file...

PT-2025-8713

Name of the Vulnerable Software and Affected Versions YZNCMS version 2.0.1 Description The issue is related to an arbitrary file upload vulnerability in the plugin installation feature. This allows attackers to execute arbitrary code by uploading a crafted Zip file. Recommendations For YZNCMS...

CVE-2025-25784

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25784: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25784

The Jizhicms content management system (version v2.5.4 ) contains an arbitrary file upload vulnerability within the TemplateController.php component. Attackers can exploit this issue by uploading a crafted Zip file to achieve arbitrary code execution . No specific patch version is currently avail...

CVE-2025-25791: Improper Neutralization of Special Elements used in a Command

An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25783

Emlog Pro v2.5.3 is vulnerable to an arbitrary file upload vulnerability in the adminackup.php (also referenced as adminackup.php or adminplugin.php in related records) component. The root cause is a lack of validation for uploaded files, which allows an attacker to upload a crafted Zip file to...

CVE-2025-25790

The open-source content management system FoxCMS v1.2.5 is susceptible to an arbitrary file upload vulnerability within the witter p emplate emplate.php (or older emplate emplate.php context, specifically referenced as controller p emplate emplate.php in some records) component. The root cause is...

JIZHICMS security vulnerabilities

JIZHICMS Jizhi CMS is an open source content management system CMS from China Jizhi JIZHI. A security vulnerability exists in JIZHICMS version v2.5.4, which originates from an arbitrary file upload issue in the cTemplateController.php component, allowing an attacker to execute arbitrary code...

CVE-2025-25790

An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file...

Arbitrary File Upload

Overview streamlit is a The fastest way to build data apps in Python Affected versions of this package are vulnerable to Arbitrary File Upload in the fileuploader.py widget, which does not enforce uploaded file type restrictions on the server side, even if they are set in the client. Remediation...

CVE-2025-1128

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVFFormFieldsUpload class in all versions up...

CVE-2025-1128 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVFFormFieldsUpload class in all versions up...

CVE-2025-1128 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVFFormFieldsUpload class in all versions up...

CVE-2025-1128 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVFFormFieldsUpload class in all versions up...

CVE-2025-1128

The CVE-2025-1128 entry concerns the Everest Forms plugin for WordPress. The vulnerability lies in the EVF_Form_Fields_Upload class, where missing file type and path validation in the format method affects all versions up to and including 3.0.9.4. This allows unauthenticated attackers to upload, ...

CVE-2025-1128: Unrestricted Upload of File with Dangerous Type

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVFFormFieldsUpload class in all versions up...