14752 matches found
PT-2025-12671
Name of the Vulnerable Software and Affected Versions Kentico Xperience versions prior to 13.0.179 Description An authenticated remote code execution issue allows authenticated users of the Staging Sync Server to upload arbitrary data to path relative locations. This leads to path traversal and...
Exploit for CVE-2024-49653
๐ WordPress Portfolleo Plugin Exploit CVE-2024-49653 ๐จ V...
CVE-2024-10902
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability...
CVE-2024-8060
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...
Exploit for CVE-2024-52375
WordPress Datasets Manager ๐ฅ Exploit by: Nxploit Khaled Alen...
CVE-2025-29411
An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...
WordPress Instant Appointment plugin <= 1.2 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Random Robbie in WordPress Plugin Instant Appointment versions = 1.2...
CVE-2025-29405
An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5. allows attackers to execute arbitrary code via uploading a crafted PHP file...
CVE-2025-29401
An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafted PHP file...
SourceCodester Best Church Management Software ไปฃ็ ้ฎ้ขๆผๆด
SourceCodester Best Church Management Software is an open source church management software from SourceCodester. A code issue vulnerability exists in version 1.0 of SourceCodester Best Church Management Software, which stems from improper manipulation of the photo/photo1 parameter in the...
CVE-2025-29411
An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...
CVE-2025-29411
An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...
Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...
Arbitrary File Upload
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Arbitrary File Upload via the audio/api/v1/transcriptions endpoint. An attacker can execute arbitrary code on the server by uploading a malicious file with a crafted filename that exploits insufficient...
GHSA-FF5C-56M7-VC75 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...
Arbitrary File Upload
Overview pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Arbitrary File Upload via the LightningApp when running on a Windows host at the /api/v1/uploadfile/ endpoint. An attacker...
GHSA-3XQ5-X4FJ-RFF7 DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability...
DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability...
Arbitrary File Upload
flowise is vulnerable to Arbitrary File Upload. The vulnerability is due to lack of access control in the whitelisted route /api/v1/attachments, allowing an unauthorized attacker to upload arbitrary files when storageType is set to local default...