CVE-2009-20006

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility admin/filemanager.php. The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to...

CVE-2025-56263

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type...

CVE-2025-55912

An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photouploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler...

WordPress Medcity theme < 1.1.9 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Medcity versions 1.1.9...

CVE-2025-9216

The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import function in all versions up to, and including, 1.5.0. This makes it possible for...

CVE-2025-9216 StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload

The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import function in all versions up to, and including, 1.5.0. This makes it possible for...

CVE-2025-9216 StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload

The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import function in all versions up to, and including, 1.5.0. This makes it possible for...

CVE-2025-9216

CVE-2025-9216 affects StoreEngine WordPress plugin versions up to 1.5.0. The vulnerability arises from an unauthenticated/file-type validation gap in the storeengine_csv/import AJAX action: uploaded files are moved to a server directory after only filename sanitization, enabling arbitrary file up...

WordPress plugin StoreEngine 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2025-38123

Name of the Vulnerable Software and Affected Versions: StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More versions prior to 1.5.1 Description: The StoreEngine WordPress plugin is susceptible to arbitrary file uploads due to the absence of file ty...

WordPress StoreEngine plugin <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Ryan Kozak in WordPress Plugin StoreEngine versions = 1.5.0...

CVE-2025-56263

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type...

CVE-2025-56263

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type...

Arbitrary File Upload

Mattermost is vulnerable to Arbitrary File Upload. The vulnerability is due to insufficient validation of upload types because remote cluster upload sessions allow system admins to upload non-attachment file types, potentially enabling placement of files in arbitrary filesystem directories...

CVE-2025-56263

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type...

CVE-2025-56263

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type...

CVE-2025-56263

The CVE-2025-56263 entry concerns by-night sms V1.0, which exposes an Arbitrary File Upload vulnerability via the /api/sms/upload/headImg endpoint. The root issue allows uploading arbitrary files of any size and type, enabling potential impact on confidentiality, integrity, and availability as re...

sms 安全漏洞

sms is a student grade management system by Jeffrey Personal Developer. A security vulnerability exists in version 1.0 of sms, which stems from the /api/sms/upload/headImg endpoint that allows the uploading of arbitrary files, which could lead to an arbitrary file upload attack...

1000 Projects Online Student Project Report 代码问题漏洞

1000 Projects Online Student Project Report is an open source online student project reporting system from 1000 Projects. A code issue vulnerability exists in version 1.0 of 1000 Projects Online Student Project Report, which stems from an incorrect manipulation of the parameter newimage in the fi...

SourceCodester Pet Grooming Management Software 代码问题漏洞

SourceCodester Pet Grooming Management Software is a SourceCodester open source pet grooming management system. A code issue vulnerability exists in version 1.0 of SourceCodester Pet Grooming Management Software, which stems from an incorrect manipulation of the parameter websiteimage in the file...