CVE-2025-12968 Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...

CVE-2025-12968 Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the uploadfile function in the infilityimportfile class only validating the MIME type which can ...

CVE-2025-12968

CVE-2025-12968 covers the Infility Global WordPress plugin. Wordfence details show an Authenticated (Subscriber+) Arbitrary File Upload vulnerability caused by: (1) upload_file MIME type validation, which can be spoofed, and (2) missing capability checks in import_data. Affected versions are up t...

WordPress plugin Infility Global 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

Arbitrary File Upload

Overview elkarte/elkarte is an ElkArte PHP-based community discussion forum. Affected versions of this package are vulnerable to Arbitrary File Upload via the theme installation process. An attacker can execute arbitrary code by uploading a ZIP archive containing a malicious PHP file, which is th...

CVE-2025-65471

An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-65471

An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file...

PT-2025-50633

Name of the Vulnerable Software and Affected Versions EasyImages versions 2.0 through 2.8.6 Description An arbitrary file upload issue exists in the /admin/manager.php component. This allows attackers to potentially execute arbitrary code by uploading a specially crafted PHP file. Recommendations...

📄 WordPress WP for CPI 1.0.2 Shell Upload

WordPress WP for CPI plugin versions 1.0.2 and below suffer from an unauthenticated shell upload vulnerability. ============================================================================================================================================= | Title : WP for CPI 1.0.2 Unauthenticated...

EUVD-2025-202765

An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-65471

An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-65471

CVE-2025-65471 affects EasyImages 2.0 up to v2.8.6, with an arbitrary file upload in /admin/manager.php that can lead to remote code execution via a crafted PHP upload. Root cause described as improper file upload handling. Public references from multiple feeds confirm the vulnerability; PT-Secur...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the media upload functionality. An attacker can execute arbitrary code on the server by uploading a specially crafted PHP file after authenticating. Remediation Upgrade dotclear/dotclear to version 2.31 or...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the filemanager upload endpoint. An attacker can execute arbitrary code on the server by uploading a crafted PHP file through authenticated access. Remediation There is no fixed version for apprain/apprain...

CVE-2025-56704

LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code...

CVE-2025-14390 Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload

The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version = 5.0.4. This is due to missing or incorrect nonce validation on the videomerchantaddvideofile function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote...

CVE-2025-14390 Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload

The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version = 5.0.4. This is due to missing or incorrect nonce validation on the videomerchantaddvideofile function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote...

CVE-2025-14390

Summary: The WordPress Video Merchant plugin (versions

Exploit for CVE-2015-9331

CVE-2015-9331 POC Vulnerability Description CVE-2015-9331...

WordPress Video Merchant plugin <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload vulnerability

Cross-Site Request Forgery to Arbitrary File Upload vulnerability discovered by Ala Arfaoui in WordPress Plugin Video Merchant versions = 5.0.4...