PT-2025-33542 · WordPress · Drag/Drop Multiple File Upload – Contact Form 7

Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress versions through 1.3.9.0 Description: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal via the wpcf7...

WordPress plugin Drag and Drop Multiple File Upload for Contact Form 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

Malicious code in ash-drag-drop (npm)

The package ash-drag-drop was found to contain malicious code...

MAL-2025-14898 Malicious code in ash-drag-drop (npm)

The package ash-drag-drop was found to contain malicious code...

CVE-2025-52712

CVE-2025-52712 is a Path Traversal vulnerability in WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor, affecting versions up to 1.27.8. Technical details across sources confirm the issue is a path traversal flaw (root cause: improper handling of file paths) that could enab...

CVE-2025-52712 WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal Vulnerability

Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through = 1.27.8...

JimuReport 代码问题漏洞

JimuReport is a free reporting tool open source by JEECG in China. A code issue vulnerability exists in JimuReport 2.1.1 and earlier versions, which stems from a misbehavior in file /drag/onlDragDataSource/testConnection leading to deserialization...

Linux Distros Unpatched Vulnerability : CVE-2022-22756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which...

Linux Distros Unpatched Vulnerability : CVE-2023-28164

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability...

BIT-MOODLE-2025-26528 Stored XSS in ddimageortext question type

The drag-and-drop onto image ddimageortext question type required additional sanitizing to prevent a stored XSS risk...

Linux Distros Unpatched Vulnerability : CVE-2019-11698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content...

Linux Distros Unpatched Vulnerability : CVE-2023-25741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility...

Linux Distros Unpatched Vulnerability : CVE-2023-23598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website coul...

CVE-2025-8520

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

CVE-2025-8519

A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to information disclosure. It is possible to...

CVE-2025-8519

A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to information disclosure. It is possible to...

CVE-2025-8520 givanz Vvveb Drag-and-Drop Editor editor server-side request forgery

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

CVE-2025-8520 givanz Vvveb Drag-and-Drop Editor editor server-side request forgery

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

CVE-2025-8520 givanz Vvveb Drag-and-Drop Editor editor server-side request forgery

A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be...

CVE-2025-8520

CVE-2025-8520 affects givanz Vvveb up to version 1.0.5, specifically the Drag-and-Drop Editor’s /vadmin123/?module=editor/editor endpoint. The issue is a server-side request forgery triggered by manipulating the url argument, enabling remote initiation. Public exploitation has been disclosed. A f...