14744 matches found
CVE-2025-49329
CVE-2025-49329 describes an unrestricted file upload vulnerability in the Agile Logix Store Locator WordPress plugin. The root cause is uploading files with dangerous types, enabling a potential web shell to be written to the server. Affected: Store Locator WordPress from any initial version up t...
CVE-2025-49329 WordPress Store Locator WordPress <= 1.5.2 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress allows Upload a Web Shell to a Web Server. This issue affects Store Locator WordPress: from n/a through 1.5.2...
Arbitrary File Upload
xyz.erupt, erupt is vulnerable to arbitrary file upload. The vulnerability is due to improper validation in the /upload/GoodsCategory/image component, allowing attackers to upload crafted files and execute arbitrary code...
CVE-2025-3054 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload
The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...
CVE-2025-3054
The CVE-2025-3054 entry affects the WP User Frontend Pro plugin for WordPress, with versions up to 4.1.3. The vulnerability is an arbitrary file upload due to missing file type validation in upload_files(), impacting authenticated users at Subscriber level and above, under conditions where the Pr...
CVE-2025-3054 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload
The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...
WordPress Store Locator WordPress plugin <= 1.5.2 - Arbitrary File Upload Vulnerability
Arbitrary File Upload Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin Store Locator WordPress versions = 1.5.2...
CVE-2025-45855
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
WordPress plugin WP User Frontend Pro 代码问题漏洞
WordPress WP User Frontend Pro plugin is a WordPress front-end user center plugin that provides powerful front-end administration features. WordPress WP User Frontend Pro plugin has a code issue vulnerability, the vulnerability stems from the lack of file type validation in the uploadfiles...
WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through a manipulated API request. An attacker can upload unauthorized files by crafting a request that bypasses the configured file extension checks. Remediation Upgrade Umbraco.Cms.Core to version 15.4.2,...
CVE-2025-45854
/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams...
GHSA-5GR5-VMMR-82G6 Erupt Unrestricted Upload of File with Dangerous Type vulnerability
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the /upload/GoodsCategory/image component. An attacker can cause code execution by uploading a malicious file. Remediation There is no fixed version for xyz.erupt:erupt. References - GitHub Gist - Vulnerabl...
CVE-2025-45855
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2025-45854
/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams...
CVE-2025-45855
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file...
JEHC-BPM 安全漏洞
JEHC-BPM is a BPM open source platform for jehc individual developers. A security vulnerability exists in JEHC-BPM v2.0.1, which originates from an arbitrary file upload in the /server/executeExec component and could lead to arbitrary code execution...
PT-2025-23615 · Erupt · Erupt
Name of the Vulnerable Software and Affected Versions: erupt version 1.12.19 Description: The issue is related to an arbitrary file upload vulnerability in the /upload/GoodsCategory/image component, which allows attackers to execute arbitrary code by uploading a crafted file. Recommendations: For...