14767 matches found
WordPress Garden Gnome Package plugin <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload vulnerability
Authenticated Author+ Arbitrary File Upload vulnerability discovered by Lucio Sá in WordPress Plugin Garden Gnome Package versions = 2.3.0...
WordPress Modula Image Gallery plugin <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload vulnerability
Authenticated Author+ Arbitrary File Upload vulnerability discovered by SavPhill Savphill in WordPress Plugin Modula Image Gallery versions = 2.11.10...
CVE-2025-22133 WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)
WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controlaxlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar,...
CVE-2025-22133 WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)
WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controlaxlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar,...
WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin 4ECPS Web Forms versions = 0.2.18...
CVE-2024-43243 WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through = 1.2.6...
CVE-2024-12471
CVE-2024-12471: Post Saint for WordPress (Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator) contains an authentication-required Arbitrary File Upload due to missing capability check and file-type validation on add_image_to_library. Affected versions inc...
CVE-2024-12471 Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the addimagetolibrary AJAX action function in all versions up to, and...
CVE-2024-12471 Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the addimagetolibrary AJAX action function in all versions up to, and...
CVE-2024-53345
An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file...
WordPress plugin Post Saint 代码注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...
CVE-2024-55078
An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uploading a crafted file...
WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Muhamad Agil Fachrian Patchstack Alliance in WordPress Plugin JobBoard Job listing versions = 1.2.6...
CVE-2024-55078
CVE-2024-55078 – WukongCRM-11.0-JAVA (v11.3.3) has an arbitrary file upload flaw in the /adminUser/updateImg component that can lead to remote code execution when a crafted file is uploaded. CVSS v3.1 base score 9.8 (CRITICAL): Network attack vector, no privileges required, no user interaction, w...
CVE-2024-55078
An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2024-55078
An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uploading a crafted file...
PT-2025-3096 · Unknown · Wukongcrm-11.0-Java
Name of the Vulnerable Software and Affected Versions: WukongCRM-11.0-JAVA version 11.3.3 Description: An arbitrary file upload vulnerability in the component /adminUser/updateImg allows attackers to execute arbitrary code via uploading a crafted file. This issue enables attackers to potentially...
ZenML < 0.55.5 Arbitrary File Upload
The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by an arbitrary file upload vulnerability in the load function at /materializers/cloudpicklematerializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2024-56264 WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector allows Upload a Web Shell to a Web Server.This issue affects ACF City Selector: from n/a through 1.14.0...