CVE-2022-3762

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrar...

CVE-2008-4388

The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods...

CVE-2024-8673 Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript...

CVE-2024-8699 Z-Downloads < 1.11.5 - Admin+ Arbitrary File Upload

The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-13544 Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

Huawei EulerOS: Security Advisory for subversion (EulerOS-SA-2025-1182)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mattermost File Upload Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a file upload vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker can exploit this vulnerability to upload malicious file...

RuvarOA id Parameter SQL Injection Vulnerability

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /SysManage/sysblogtemplatenew.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

PYSEC-2024-253

pretix before 2024.1.1 mishandles file validation...

PT-2024-21903 · Pretix · Pretix

Name of the Vulnerable Software and Affected Versions: pretix versions prior to 2024.1.1 Description: The issue is related to the mishandling of file validation. Recommendations: For versions prior to 2024.1.1, update to version 2024.1.1 or later to resolve the issue...

PT-2023-32568 · WordPress · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress plugin for WordPress versions up to, and including, 1.0.76 Description: The issue is related to insufficient file validation on the bookingpress process upload function, allowing authenticated attackers with administrator-level...

Simple Photo Gallery Arbitrary File Upload Vulnerability

Simple Photo Gallery is a simple gallery web application. An arbitrary file upload vulnerability exists in Simple Photo Gallery v1.0, which stems from the application's lack of validation of uploaded files. The vulnerability can be exploited to remotely execute arbitrary code by uploading malicio...

CVE-2022-3416 WPtouch < 4.3.45 - Admin+ Arbitrary File Upload

The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

Hoosk CMS Arbitrary File Upload Vulnerability

Hoosk CMS is a lightweight content management system. Hoosk CMS v1.8.0 suffers from an arbitrary file upload vulnerability that stems from its /attachments component failing to validate uploaded files. An attacker can exploit the vulnerability to remotely execute code...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

Flash Player <= 16.0.0.235 Multiple Vulnerabilities (APSB15-01)

According to its version, the installation of Adobe Flash Player installed on the remote Windows host is equal or prior to 16.0.0.235. It is, therefore, affected by the following vulnerabilities : - An unspecified improper file validation issue. CVE-2015-0301 - An unspecified information disclosu...