14740 matches found
CVE-2013-10067
Glossword (versions 1.8.8–1.8.12) contains an authenticated arbitrary file upload flaw in the gw_admin.php interface. Insufficient validation of file type/path allows an administrator to upload PHP payloads to gw_temp/a/, enabling remote code execution. Public advisories and a Metasploit module r...
CVE-2013-10067 Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCE
Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gwadmin.php allows users with administrator privileges to upload files to the gwtemp/a/ directory. Due to insufficient...
CVE-2012-10030 FreeFloat FTP Server Arbitrary File Upload
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or...
CVE-2012-10030 FreeFloat FTP Server Arbitrary File Upload
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or...
CVE-2012-10030
The CVE-2012-10030 entry describes a vulnerability in FreeFloat FTP Server where unauthenticated attackers can upload arbitrary files to sensitive system directories (e.g., C:\ root, system32, wbem\mof). The underlying issue is design flaws that allow unrestricted file uploads and destination pat...
CVE-2014-125113
The Dell/Quest KACE K1000 System Management Appliance (versions 5.0–5.3, 5.4 before 5.4.76849, and 5.5 before 5.5.90547) is affected by an unauthenticated unrestricted file upload vulnerability in the download_agent.php endpoint. An attacker can upload PHP files to a temporary web‑accessible dire...
CVE-2025-5061
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-5061 WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-5061
CVE-2025-5061 affects WordPress plugin WP Import Export Lite (versions ≤ 3.9.29). The vulnerability arises from missing file type validation in the wpie_parse_upload_data function, enabling authenticated users with Subscriber-level access (and those granted by an Administrator) to upload arbitrar...
CVE-2025-6207 WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
CVE-2025-6207 WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
CVE-2025-6207
The WP Import Export Lite plugin for WordPress is affected by an arbitrary file upload vulnerability caused by missing file type validation in the wpie_tempalte_import function, affecting all versions up to and including 3.9.28. Authenticated users with Subscriber-level access or higher, and with...
CVE-2025-6207
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
Kordil EDMS 安全漏洞
Kordil EDMS is an open source electronic document management system from the Turkish company Kordil. The system supports features such as document management and document control. A security vulnerability exists in Kordil EDMS version v2.2.60rc3, which stems from an unvalidated uploaded file type...
PT-2025-31991 · Glossword · Glossword
Name of the Vulnerable Software and Affected Versions: Glossword versions 1.8.8 through 1.8.12 Description: Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gw admin.php...
WordPress plugin WP Import Export Lite 代码问题漏洞
WordPress WP Import Export Lite plugin is the official WordPress recommended import and export plugin that supports batch processing of site data, including posts, pages, taxonomies, comments and user data, etc. It supports a variety of file formats such as CSV, JSON, XML and so on. WordPress WP...
Dell KACE K1000 System Management Appliance 安全漏洞
The Dell KACE K1000 System Management Appliance is a tool for IT systems and asset management from Dell USA. A security vulnerability exists in the Dell KACE K1000 System Management Appliance versions 5.0 through 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547, which stems from an...
WordPress WP Import Export Lite plugin <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin WP Import Export Lite versions = 3.9.29...
WordPress WP Import Export Lite plugin <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin WP Import Export Lite versions = 3.9.28...
