CVE-2025-2155 Arbitrary File Upload in EchoCCS's Specto CM

Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025...

CVE-2023-53942 File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with ...

CVE-2025-64231

The CVE-2025-64231 entry concerns the WordPress plugin RTW WordPress Contact Form 7 PDF, Google Sheet & Database (rtwwcfp-wordpress-contact-form-7-pdf) versions up to 3.0.0. The vulnerability is an Unrestricted Upload of File with Dangerous Type, allowing upload of malicious files via the plugin’...

CVE-2025-34437 AVideo < 20.1 IDOR Arbitrary Comment Image Upload

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects...

Arbitrary File Upload

Overview soosyze/soosyze is a Soosyze CMS is a minimalist content management system in PHP, without database to create and manage your website easily. Affected versions of this package are vulnerable to Arbitrary File Upload via the upload endpoint. An attacker can execute arbitrary PHP code and...

PT-2025-49357

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery versions 4.5.4 through 4.5.7 Description The All-in-One Video Gallery plugin for WordPress has a flaw that allows unauthorized file uploads. This is due to a lack of proper file type checking within the resolve import...

CVE-2025-12154 Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload

The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload...

CVE-2025-63994

Summary (concrete details from connected docs): RichFilemanager v2.7.6 contains an arbitrary file upload vulnerability in the /php/UploadHandler.php component that can allow code execution when a crafted file is uploaded. This is corroborated by multiple sources (Red Hat and ENISA/CNNVD entries)....

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-6327

The CVE-2025-6327 entry concerns the WordPress plugin King Addons for Elementor, versioned up to 51.1.36, which suffers an Unrestricted Upload of File with Dangerous Type vulnerability in king-addons. The flaw allows uploading a web shell to the web server via the plugin (arbitrary file upload vu...

CVE-2025-62016 WordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through = 4.22.0...

CVE-2025-10896

CVE-2025-10896 affects multiple WordPress plugins in the Jewel Theme Recommended Plugins Library. The vulnerability is Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation due to missing capability checks in the *_recommended_upgrade_plugin function, enabling authenti...

CVE-2025-11675

CVE-2025-11675 affects Ragic’s Enterprise Cloud Database. The connected sources describe an Arbitrary File Upload vulnerability that lets privileged remote attackers upload and execute web shell backdoors, enabling arbitrary code execution on the server. The reports consistently name the affected...

CVE-2025-11660

A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some unknown functionality of the file /assets/uploadSllyabus.php. Such manipulation of the argument File leads to unrestricted upload. The atta...

Get Projects School Management System 代码问题漏洞

Get Projects School Management System is a Get Projects open source school management system software. A code issue vulnerability exists in Get Projects School Management System, which stems from a misbehavior of the parameter File in the file /assets/uploadSllyabus.php, which could lead to...

CVE-2025-9212

The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpdispatcherprocessupload function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

EUVD-2025-25059

Malicious code in bioql PyPI...

PT-2025-38519

Name of the Vulnerable Software and Affected Versions Embed PDF for WPForms plugin for WordPress versions up to and including 1.1.5 Description The Embed PDF for WPForms plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation within the ajax handle...

WordPress plugin Responsive Filterable Portfolio 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Responsive Filterable Portfolio plugin has an arbitrary file upload vulnerability that stems from a lack of file type validation in the HdnMediaSelectionimage fiel...

CVE-2025-31100 WordPress School Management Plugin <= 1.93.1 (02-07-2025) - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to a Web Server.This issue affects School Management: from n/a through 1.93.1 02-07-2025...