CVE-2024-13448 ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data

The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trxaddonsuploadssavedata' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2024-13448

CVE-2024-13448 affects the ThemeREX Addons WordPress plugin via arbitrary file uploads due to missing file type validation in trx_addons_uploads_save_data, affecting all versions up to 2.32.3. Unauthenticated upload could lead to remote code execution. Red Hat and other sources indicate remediati...

Tandoor Recipes: Code Issues and Vulnerabilities

Tandoor Recipes is a Tandoor Recipes open source application for managing recipes, planning meals, creating shopping lists and more. A code issue vulnerability exists in Tandoor Recipes versions prior to 1.5.28, which stems from a file upload feature that allows the upload of arbitrary files,...

PT-2025-4852 · Unknown · Tandoor Recipes

Name of the Vulnerable Software and Affected Versions: Tandoor Recipes versions prior to 1.5.28 Description: The issue concerns the file upload feature in Tandoor Recipes, which allows uploading arbitrary files, including html and svg. These files can contain malicious content, such as XSS...

CVE-2024-13448: Unrestricted Upload of File with Dangerous Type

The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trxaddonsuploadssavedata' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Cross-Site Request Forgery to Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Noah Stead TurtleBurg in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.7.2...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload at the /admin/media/upload, which checks file types in the upload function. An authenticated user with the browsemedia privilege can provide a file spoofing one of the allowedMimeTypes, that contains malicious code...

WordPress WPBookit plugin <= 1.6.9 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin WPBookit versions = 1.6.9...

CVE-2024-11641

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugi...

CVE-2024-11641 VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugi...

CVE-2024-11641: Cross-Site Request Forgery (CSRF)

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugi...

CVE-2025-0357 WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPBProfilecontroller::handleimageupload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

CVE-2025-0357: Unrestricted Upload of File with Dangerous Type

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPBProfilecontroller::handleimageupload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

CVE-2025-24650 WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic allows Upload a Web Shell to a Web Server. This issue affects Tourfic: from n/a through 2.15.3...

CVE-2025-24650

CVE-2025-24650 is a WordPress Tourfic plugin vulnerability (versions

WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by l8BL in WordPress Plugin Tourfic versions = 2.15.3...

CVE-2024-55926

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...

CVE-2024-55926

CVE-2024-55926 affects Xerox Workplace Suite (print server) via crafted header manipulation, enabling arbitrary file read, upload, and deletion due to improper header validation. Root cause: insufficient validation of HTTP headers leading to unauthorized data access. Affected versions: Xerox Work...

CVE-2024-55926 Arbitrary file upload, deletion and read through header manipulation

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...

CVE-2024-55926 Arbitrary file upload, deletion and read through header manipulation

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data...