PT-2024-33508 · Elvaco · M-Bus Metering Gateway Cme3100 +1

Name of the Vulnerable Software and Affected Versions: Product affected versions not specified Description: The issue concerns unrestricted file uploads, which may allow an attacker to remotely execute code. This can potentially lead to an attacker running code from a remote location...

PT-2024-39885 · WordPress · Product Customizer Light

Name of the Vulnerable Software and Affected Versions: Product Customizer Light plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

PT-2024-16025 · Comfyui · Comfyui

Name of the Vulnerable Software and Affected Versions: comfyanonymous/comfyui version 0.2.2 and possibly earlier Description: A stored cross-site scripting XSS issue exists, allowing an attacker to upload an HTML file with a malicious XSS payload via the "/api/upload/image" endpoint. The payload ...

CVE-2024-8921

The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acce...

CVE-2024-9444

The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2024-9444

CVE-2024-9444 : The ElementsReady Addons for Elementor WordPress plugin is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to and including 6.4.3 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Author leve...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

CVE-2016-15042

The Frontend File Manager versions 4.0, N-Media Post Front-end Form versions 1.1 plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the nmfilemanageruploadfile and nmpostfrontuploadfile AJAX actions. This makes it possible for unauthenticated...

CVE-2020-36842

CVE-2020-36842 — WPvivid WordPress plugin : The Migration, Backup, Staging WPvivid plugin is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions. This allows low‑level authenticated attackers to upload zip...

CVE-2016-15042

The CVE-2016-15042 issue affects WordPress plugins Frontend File Manager (<4.0) and N-Media Post Front-end Form (

CVE-2024-8746

The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mkfilefoldermanagershortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if grant...

CVE-2021-4449

The ZoomSounds WordPress plugin (versions up to and including 5.96) contains a file upload vulnerability in savepng.php due to missing file type validation. This allows unauthenticated attackers to upload arbitrary files on the vulnerable site’s server, with potential remote code execution. CVE-2...

WordPress plugin Azz Anonim Posting 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Migration, Backup, Staging – WPvivid 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Migration,...

PT-2024-33380

Name of the Vulnerable Software and Affected Versions Shafiq Digital Lottery versions 3.0.5 and earlier Description The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized access to...

PT-2024-33399 · WordPress · Wordpress Gallery Plugin

Name of the Vulnerable Software and Affected Versions: Limb WordPress Gallery Plugin – Limb Image Gallery versions 1.5.7 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, allowing Code Injection in the Limb Image Gallery Plugin. This enables...

PT-2024-39062 · WordPress · File Manager Pro

Name of the Vulnerable Software and Affected Versions: File Manager Pro plugin for WordPress versions up to, and including, 8.3.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'mk file folder manager' ajax action. This allows...

CVE-2024-9904

CVE-2024-9904 affects 07FLYCMS, 07FLY-CMS and 07FlyCRM up to version 1.2.0. The flaw is in the function pictureUpload under /admin/File/pictureUpload, where manipulating the file argument enables unrestricted remote upload. Exploitation has been publicly disclosed; multiple sources corroborate th...

CVE-2024-9756

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on the wcoaaddattachment AJAX action in versions 2.0 to 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access...