CVE-2025-51459

File Upload vulnerability in agent.hub.controller.refreshplugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with pluginhub.sanitizefilename and pluginsutil.scanplugi...

CVE-2025-51459: Improper Neutralization of Special Elements used in a Command

File Upload vulnerability in agent.hub.controller.refreshplugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with pluginhub.sanitizefilename and pluginsutil.scanplugi...

BIT-PHPLIST-2020-22249

Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which would lead to the...

PhpList code-related vulnerabilities

phpList is an open source newsletter and email marketing software from phpList UK. A remote code execution vulnerability exists in phpList version 3.5.1, which stems from the product's failure to check for any file extensions stored in the plugin's zip file, and can be exploited by an attacker wh...