CVE-2025-0394 Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ghbigfileupload function in all versions up to, and including, 3.7.3.5. This makes it possible for...

PT-2025-3555 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions prior to 2025.01.01 Description: The issue is related to an arbitrary file upload vulnerability in the parserXML method. This allows attackers to execute arbitrary code via uploading a crafted file. There is no information...

CVE-2024-57761

An arbitrary file upload vulnerability in the parserXML method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-57761

Summary (CVE-2024-57761) The JeeWMS application contains an arbitrary file upload vulnerability in the parserXML() method that can lead to remote code execution. Affected lineage is JeeWMS versions prior to 2025.01.01; exploitation involves uploading a crafted file to trigger arbitrary code execu...

CVE-2024-57761

An arbitrary file upload vulnerability in the parserXML method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file...

PT-2025-1063 · Unknown · Websoft Hcm

Name of the Vulnerable Software and Affected Versions: Websoft HCM affected versions not specified Description: The issue is related to the Websoft HCM software, which has a vulnerability associated with arbitrary file upload. This could allow a remote attacker to execute arbitrary code by creati...

PT-2025-3865 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 3.7.3.5 Description: The issue is related to the lack of file type validation in the gh big file upload function, which allows authenticated attackers with Author-level access and...

4ECPS Web Forms <= 0.2.18 - Unauthenticated Arbitrary File Upload

Description The 4ECPS Web Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.2.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may mak...

WordPress Groundhogg plugin <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function vulnerability

Authenticated Author+ Arbitrary File Upload via ghbigfileupload Function vulnerability discovered by wesley wcraft in WordPress Plugin Groundhogg versions = 3.7.3.5...

CVE-2024-46479

Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, leading to remote code execution...

CVE-2024-46479

Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, leading to remote code execution...

CVE-2024-46479

CVE-2024-46479 affects Venki Supravizio BPM up to version 18.0.1, which contains an arbitrary file upload vulnerability that could allow an authenticated attacker to upload a malicious file and achieve remote code execution. Connected sources confirm the component and impact; no remediation detai...

Exploit for CVE-2024-9932

CVE-2024-9932-POC Description: The Wux Blog Editor WordPre...

CVE-2024-46210

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file...

REDAXO 安全漏洞

REDAXO is a content management system from REDAXO open source. A security vulnerability exists in REDAXO v5.17.1, which originates from an arbitrary file upload in the MediaPool module, allowing an attacker to execute arbitrary code by uploading a crafted file...

CVE-2024-46210

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-46210

CVE-2024-46210 describes an arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 that can allow attackers to execute arbitrary code via uploading a crafted file. Documents consistently identify the affected component as the MediaPool module and the target version as R...

CVE-2025-22504

CVE-2025-22504 involves the 4ECPS Web Forms plugin. It is an Unrestricted Upload of File with Dangerous Type vulnerability that permits uploading a web shell to the server. Public details indicate affected software: 4ECPS Web Forms versions from unspecified start to 0.2.18. The CVE is linked to a...

CVE-2025-22504 WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through = 0.2.18...

CVE-2024-12848 SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...