CVE-2024-46210: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file...

REDAXO security vulnerabilities

REDAXO is a content management system from REDAXO open source. A security vulnerability exists in REDAXO v5.17.1, which originates from an arbitrary file upload in the MediaPool module, allowing an attacker to execute arbitrary code by uploading a crafted file...

CVE-2024-46210

Redaxo CMS v5.17.1 is vulnerable to an arbitrary file upload vulnerability within the MediaPool module. This flaw allows an attacker to upload a crafted file to execute arbitrary code on the system. To mitigate this risk, it is recommended to disable the MediaPool module until a patch is released...

CVE-2025-22504 WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through = 0.2.18...

CVE-2025-22504

CVE-2025-22504 involves the 4ECPS Web Forms plugin. It is an Unrestricted Upload of File with Dangerous Type vulnerability that permits uploading a web shell to the server. Public details indicate affected software: 4ECPS Web Forms versions from unspecified start to 0.2.18. The CVE is linked to a...

CVE-2024-12848

CVE-2024-12848 concerns the SKT Page Builder plugin for WordPress. The vulnerability allows authenticated users with subscriber-level access or higher to upload arbitrary files due to a missing authorization check in the addLibraryByArchive function across all versions up to 4.6, enabling potenti...

CVE-2024-12848 SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...

CVE-2024-12848 SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...

CVE-2024-43662

The .exe or .exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any user, although the user interface for uploading files is only shown to the iocadmin user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderat...

CVE-2024-43662

CVE-2024-43662 affects Iocharger firmware for AC models prior to 24120701. A .exe CGI binary, accessible only to iocadmin users, can upload arbitrary files to /tmp/upload/ or /tmp/ as any user. Exploitation requires knowledge of the CGI binary and a low-privilege account to access it and perform ...

CVE-2024-12848: Missing Authorization

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...

PT-2025-1963 · WordPress · Skt Page Builder

Name of the Vulnerable Software and Affected Versions: SKT Page Builder plugin for WordPress versions up to, and including, 4.6 Description: The issue allows for arbitrary file uploads due to a missing capability check on the addLibraryByArchive function. This makes it possible for authenticated...

PT-2025-2663 · Iocharger · Iocharger

Name of the Vulnerable Software and Affected Versions: Iocharger firmware for AC models versions prior to 24120701 Description: The issue allows attackers to upload arbitrary files to /tmp/upload/ or /tmp/ as any user, although the file upload interface is only visible to the iocadmin user. The...

iocharger security vulnerability

iocharger is an electric vehicle charging and smart energy management solution from Galaxy Zhangtan iocharger, a Chinese company. A security vulnerability exists in iocharger. An attacker exploiting this vulnerability could upload arbitrary files to /tmp/upload/ or /tmp/...

WordPress SKT Page Builder plugin <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin SKT Page Builder versions = 4.7...

CVE-2024-12854 Garden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload

The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. This makes it possible for authenticated...

CVE-2024-12853 Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to uploa...

CVE-2024-12854 Garden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload

The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. This makes it possible for authenticated...

CVE-2024-12854

CVE-2024-12854 concerns Garden Gnome Package (WordPress) where all versions up to 2.3.0 are vulnerable due to missing file type validation when extracting uploaded ggpkgs. This enables an attacker with Author+ privileges to upload arbitrary files to the server, with potential remote code executio...

CVE-2024-12853 Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to uploa...