CVE-2024-13365: Unrestricted Upload of File with Dangerous Type

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extracting .zip archives when scanning them for malware through the checkUploadedArchive function in all versions up to, and including, 2.149. This makes it possib...

CVE-2024-10960: Unrestricted Upload of File with Dangerous Type

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all versions up to, and including, 2.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

WordPress All-Images.ai plugin <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by mr6urnz in WordPress Plugin All-Images.ai versions = 1.0.4...

CVE-2025-26411

The Wattsense Bridge IoT gateway is vulnerable to an unrestricted file upload flaw within its web interface Plugin Manager . An authenticated attacker with a valid user account can upload malicious Python files , which leads to remote root access on the device. This vulnerability affects versions...

WordPress Zarinpal Paid Downloads plugin <= 2.3 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Bob Matyas in WordPress Plugin Zarinpal Paid Download versions = 2.3...

CVE-2024-13544 Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-13544 Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-13544: Unrestricted Upload of File with Dangerous Type

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-13011

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...

CVE-2024-13011 WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...

CVE-2024-57407

An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-57408

An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file...

WordPress WP Foodbakery plugin <= 4.7 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin FoodBakery versions = 4.7...

CVE-2024-57407

Timo version v2.0.3 , a backend management system, contains an arbitrary file upload vulnerability in the /userPicture component. An attacker can exploit this flaw by uploading a specially crafted file to achieve arbitrary code execution . As no patch is currently provided, it is recommended to d...

CVE-2024-57407

An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-57408

An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-57408

An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file...

PT-2025-6074 · Timo · Timo

Name of the Vulnerable Software and Affected Versions: Timo version 2.0.3 Description: An arbitrary file upload vulnerability in the component /userPicture allows attackers to execute arbitrary code via uploading a crafted file. Recommendations: For Timo version 2.0.3, consider disabling the...

CVE-2024-57408

The backend privilege management framework cool-admin-java v1.0 is affected by an arbitrary file upload vulnerability in the /comm/upload component. An attacker can upload a specially crafted file to achieve arbitrary code execution . To mitigate this risk, it is recommended to disable the /comm/...

CVE-2024-57407: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file...