PT-2025-53705

Name of the Vulnerable Software and Affected Versions BPMFlowWebkit affected versions not specified Description BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an arbitrary file upload issue. This allows unauthenticated remote attackers to upload and execute web shell backdoors, leading to...

Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons

Royal Elementor Addons ≤ 1.3.78 – Unauthenticated Arbitrary Fi...

WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Contentstudio versions = 1.3.7...

WordPress GravityForms plugin < 2.9.23.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Marc Montpas in WordPress Plugin Gravity Forms versions 2.9.23.1...

CVE-2025-2155 Arbitrary File Upload in EchoCCS's Specto CM

Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025...

CVE-2025-2155

CVE-2025-2155 affects Specto CM (Echo Call Center Services Trade and Industry Inc.). The vulnerability is an Unrestricted Upload of File with Dangerous Type, enabling Remote Code Inclusion. Affected versions are before 17032025. Root cause: improper file‑type validation allowing executable conten...

WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter in WordPress Plugin MapSVG versions = 8.7.3...

CVE-2025-13407 GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload...

CVE-2025-13407 GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload...

CVE-2025-13407

The CVE concerns the Gravity Forms WordPress plugin (versions prior to 2.9.23.1). A flaw in the chunked upload feature allows uploading of dangerous files (e.g., PHP) to the upload path, enabling Remote Code Execution if the path is discovered or enumerated. Several connected sources corroborate ...

WordPress File Uploader for WooCommerce plugin <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data vulnerability

Unauthenticated Arbitrary File Upload via add-image-data vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin File Uploader for WooCommerce versions = 1.0.3...

CVE-2025-51511

Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...

EUVD-2025-204847

Cadmium CMS has a background arbitrary file upload vulnerability...

GHSA-QX44-P258-3C2V Cadmium CMS has a background arbitrary file upload vulnerability

Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...

CVE-2025-51511

Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...

CVE-2025-67288

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation as shown in the documentation belongs to the system administrator who is...

CVE-2025-67289

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file...

Cadmium CMS 安全漏洞

Cadmium CMS is a content management system from Cadmium open source. A security vulnerability exists in Cadmium CMS version 0.4.9, which originates from an arbitrary file upload in /admin/content/filemanager/uploads...

PT-2025-52846

Name of the Vulnerable Software and Affected Versions Cadmium CMS version 0.4.9 Description Cadmium CMS version 0.4.9 has a background arbitrary file upload issue in the /admin/content/filemanager/uploads endpoint. The vulnerability allows for unauthorized file uploads. The uploads directory is t...

CVE-2025-51511

Cadmium CMS v0.4.9 is affected by a background arbitrary file upload vulnerability at /admin/content/filemanager/uploads. The issue allows an attacker to upload crafted files via that endpoint, with potential to upload malicious files and even execute arbitrary code according to Snyk’s descriptio...