Sim Studio 安全漏洞

Sim Studio is an AI agent workflow builder from Sim Studio Open Source. A security vulnerability exists in Sim Studio that stems from an arbitrary file upload due to incorrect manipulation of the parameter File in the file apps/sim/app/api/files/upload/route.ts...

CVE-2025-9739 Campcodes Online Water Billing System process.php sql injection

A vulnerability has been found in Campcodes Online Water Billing System 1.0. Affected by this issue is some unknown functionality of the file /process.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2025-9475

A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /AdminDashboard/process/editemployeeprocess.php. This manipulation of the argument employeefile201 causes unrestricted upload. The attack may be...

CVE-2025-9475

A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /AdminDashboard/process/editemployeeprocess.php. This manipulation of the argument employeefile201 causes unrestricted upload. The attack may be...

CVE-2025-9476

CVE-2025-9476 affects the SourceCodester Human Resource Information System 1.0, specifically an issue in the file /Superadmin_Dashboard/process/editemployee_process.php. The vulnerability arises from manipulation of the argument employee_file201, enabling an unrestricted file upload. This can be ...

CVE-2025-50971

CVE-2025-50971 affects AbanteCart v1.4.2, exposing a directory traversal flaw that allows unauthenticated access to sensitive system files via the template parameter in index.php. Impact is a confidentiality breach; there is no indication of integrity/availability compromise in the provided sourc...

Yifang CMS 安全漏洞

Yifang CMS is a PHP enterprise website development and construction management system from China Yifang Company. A security vulnerability exists in Yifang CMS 2.0.5 and earlier versions, which originates from the improper handling of the File parameter in the mergeMultipartUpload function in the...

CVE-2025-7761

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting XSS. Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did no...

CVE-2025-7761

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting XSS. Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did no...

litemall 代码问题漏洞

litemall is a small mall system for linlinjava individual developers. A code issue vulnerability exists in litemall 1.8.0 and earlier versions, which stems from an incorrect operation of the File parameter File in the file...

CVE-2025-55169 WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/downloadremessa.php endpoint. This vulnerability could allow an attacker to...

CVE-2025-8764

A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclose...

litemall 代码问题漏洞

litemall is a small shopping mall system for linlinjava individual developers. A code issue vulnerability exists in litemall 1.8.0 and earlier versions, which stems from improper handling of the parameter File in the file /wx/storage/upload, which could lead to unlimited uploads...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. Bottinelli Informatical Vedo Suite suffers from a server-side request forgery vulnerability, which originates from the /apivedo/video/preview endpoint that do...

Directory Traversal

Overview vvvebjs is a Drag and drop website builder javascript library Affected versions of this package are vulnerable to Directory Traversal via the File argument in the /save.php endpoint. An attacker can access or modify files outside the intended directory by supplying crafted input to the...

XBoot 代码问题漏洞

XBoot is a one-stop front-end and back-end separation rapid development platform for Exrick individual developers. A code issue vulnerability exists in XBoot 3.3.4 and prior versions, which stems from an incorrect manipulation of the parameter File resulting in unlimited uploads...

CVE-2025-50184

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

CVE-2025-50184 DbGate allows for File Traversal via file parameter

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

CVE-2025-50184 DbGate allows for File Traversal via file parameter

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

CVE-2025-50184

DbGate (cross‑platform database manager) contains a directory traversal vulnerability in the uploads/file handling. In versions 6.4.3-premium-beta.5 and earlier, the file parameter is not restricted to the uploads directory, allowing an attacker to craft a path to read arbitrary files outside tha...