CVE-2023-25202

CVE-2023-25202: 不安全的文件上传机制 描述 CVE-2023-25202 涉及 Therefore 应用程序中的一个不安全文件上传机制，该机制对用户可上传的文件类型过于宽松。应用程序仅阻止上传 HTML、EXE 和 BAK 文件，导致其对 PHP、ASP、ASPX 和 JSP 等技术文件的上传存在漏洞。这些文件类型在某些条件下可能允许执行系统命令，尽管在此上下文中不可利用。 该应用程序针对 HTML 文件上传的安全防护可以通过上传支持 HTML 的 Markdown...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion

The News & Blog Designer Pack WordPress plugin up to version 3.4.1 contains a remote code execution caused by local file inclusion in the bdpgetmorepost function, letting unauthenticated attackers include arbitrary PHP files, exploit requires AJAX request with crafted POST data. id: CVE-2023-5815...

WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read

WooCommerce Designer Pro theme for WordPress = 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication. id: CVE-2025-10897 info: nam...

CVE-2025-6440-Poc-Exploit

WC Designer Pro — 認証なし任意ファイルアップロード セキュリティ研究用概念実証（PoC） WC Designer Pro WordPress プラグインに影響を及ぼす認証なし任意ファイルアップロードの脆弱性に対する非破壊的な概念実証（PoC）です。 目次 脆弱性の概要 セキュリティへの影響 影響を受けるバージョン 根本原因 攻撃の流れ 要件 インストール 使用方法 技術的詳細 安全な検証 暴露の兆候 対策 法的・倫理的な利用 開示状況 参考情報 クレジット 脆弱性の概要 WC Designer Pro には、WordPress の admin-ajax.php...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8（严重） 📝 描述 适用于 WordPress 的 WooCommerce Designer Pro 插件（广泛使用，尤其是在 Pricom - Printing Company & Design Services 等主题中）由于在 wcdpsavecanvasdesignajax 函数中缺乏正确的文件类型验证，所有版本（包括 1.9.26 及更早版本）均存在 任意文件上传 漏洞。 这可能导致未经认证的攻击者将 任何文件类型...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro 缓解措施 将 Canvas Designer 插件更新到已修复该漏洞的最新版本。或者，限制直接文件上传，并确保在插件中对上传文件内容进行适当的验证。 建议站点管理员： 立即移除易受攻击的版本。 应用安全加固，例如在上传目录中禁用 PHP 执行。 使用 Web 应用防火墙（WAF）阻止恶意 AJAX 请求。...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-47027, CVE-2026-47063, CVE-2026-60147 Vulnerability Details CVEID:CVE-2026-47063 DESCRIPTION: Easily exploitable vulnerabilit...

CVE-2026-82865

pdfme schemas versions prior to 5.5.10 are affected by a cross-site scripting (XSS) vulnerability in the multiVariableText property panel . The root cause is the assignment of unsanitized i18n label values to innerHTML , allowing an attacker who controls label overrides via options.labels to inje...

CVE-2025-10897

CVE-2025-10897 WooCommerce は、WordPress サイトをオンラインストアに変えるオープンソースの eコマースプラグインです。WooCommerce Designer Pro は、JMA Plugins が開発した WordPress プラグインで、顧客が WooCommerce ストア上で直接製品をデザイン・カスタマイズできるようにします。 重要 : WooCommerce と WooCommerce Designer Pro はまったく異なります。 WooCommerce Designer Pro...

WordPress-News-and-Blog-Designer-Bundle-CVE-2025-14502

Rapporto di analisi della vulnerabilità CVE-2025-14502 Riepilogo della vulnerabilità Tipo di vulnerabilità : Inclusione locale di file Local File Inclusion, LFI Versioni interessate : News and Blog Designer Bundle 1.1 e tutte le versioni precedenti Gravità : Alta Complessità dell'attacco : Bassa...

CVE-2025-6440

🧨 CVE-2025-6440 – WooCommerce Designer Pro Uneingeschränkter Datei-Upload Nicht authentifizierter Upload beliebiger Dateien überwcdpsavecanvasdesignajax WooCommerce Designer Pro-Plugin – Remote Code Execution RCE 📖 Beschreibung Das WooCommerce Designer Pro -Plugin für WordPress enthält eine...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Iniezione SQL non autenticata Descrizione Il plugin Fancy Product Designer per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 6.4.3 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di...

Disclosures

Offenlegungen Dieses Repository enthält meine Schwachstellenberichte, die weder unter eine NDA fallen noch durch die VRP-Nutzungsbedingungen eingeschränkt sind. Inhalt Fancy Product Designer Microsoft Xfinity...

Adobe Substance 3D Designer < 16.0.5 Multiple Vulnerabilities (APSB26-115)

The version of Adobe Substance 3D Designer installed on the remote host is prior to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-115 advisory. - Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in...

CVE-2026-71564

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48431

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48432

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48433

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48426

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...