CVE-2025-23922

CVE-2025-23922 concerns the WordPress iSpring Embedder plugin

WordPress Advanced File Manager plugin 5.2.12-5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin Advanced File Manager versions 5.2.12-5.2.13...

WordPress user files plugin <= 2.4.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Colin Xu in WordPress Plugin user files versions = 2.4.2...

WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Le Ngoc Anh in WordPress Plugin WP Load Gallery versions = 2.1.6...

WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability

CSRF to Arbitrary File Upload vulnerability discovered by Colin Xu in WordPress Plugin iSpring Embedder versions = 1.0...

WordPress Smallerik File Browser plugin <= 1.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Colin Xu in WordPress Plugin Smallerik File Browser versions = 1.1...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Colin Xu in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.3...

CVE-2024-57728

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...

CVE-2024-41454

An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary code via uploading a crafted PHP or HTML file...

WordPress Barcode Scanner and Inventory manager plugin <= 1.6.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by l8BL Patchstack Alliance in WordPress Plugin Barcode Scanner with Inventory & Order Manager versions = 1.6.7...

Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks

Cybersecurity researchers have disclosed multiple security flaws in SimpleHelp remote access software that could lead to information disclosure, privilege escalation, and remote code execution. Horizon3.ai researcher Naveen Sunkavally, in a technical report detailing the findings, said the...

CVE-2024-57761

An arbitrary file upload vulnerability in the parserXML method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-57728

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...

PT-2025-2607

Name of the Vulnerable Software and Affected Versions Process Maker pm4core-docker version 4.1.21-RC7 Description The issue is related to an arbitrary file upload vulnerability in the UI login page logo upload function. This allows attackers to execute arbitrary code by uploading a crafted PHP or...

CVE-2024-41454

An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary code via uploading a crafted PHP or HTML file...

CVE-2024-57728: Improper Link Resolution Before File Access

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...

CVE-2024-41454: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary code via uploading a crafted PHP or HTML file...

CVE-2024-41454

ProcessMaker pm4core-docker version 4.1.21-RC7 is vulnerable to an arbitrary file upload flaw within the UI login page logo upload function. Due to a lack of proper input validation, an attacker can bypass image restrictions to upload crafted PHP or HTML files, potentially leading to arbitrary co...

CVE-2024-57761: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the parserXML method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2025-0394

The CVE-2025-0394 entry concerns the WordPress Groundhogg plugin (WordPress CRM, Email & Marketing Automation). The connected Wordfence RH entry confirms an authentication-relevant issue: Groundhogg