775 matches found
CVE-2012-10036 Project Pier <= 0.8.8 Arbitrary File Upload RCE
Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/uploadfile.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. T...
CVE-2012-10036
CVE-2012-10036 affects Project Pier
CVE-2012-10052 EGallery 1.2 Arbitrary PHP File Upload
EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory...
PT-2025-32393 · Unknown · Projectpier
Name of the Vulnerable Software and Affected Versions: Project Pier versions 0.8.8 and earlier Description: Project Pier is susceptible to an unauthenticated arbitrary file upload issue in the tools/upload file.php script. The upload process does not validate file types or require authentication,...
PT-2025-32405 · Gallery · Gallery
Name of the Vulnerable Software and Affected Versions: EGallery version 1.2 Description: EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application does not validate file types or enforce authentication, allowing remote...
PT-2025-32398 · Xoda · Xoda
Name of the Vulnerable Software and Affected Versions: XODA version 0.4.5 Description: XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to...
CVE-2012-10027
WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party uploadify.php script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution...
CVE-2012-10027
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party uploadify.php script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution...
Exploit for Unrestricted Upload of File with Dangerous Type in Hasthemes Download_Contact_Form_7_Widget_For_Elementor_Page_Builder_\&_Gutenberg_Blocks
WordPress HT Contact Form Widget | CVE-2025-7340 File Upload V...
Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import
This module exploits an authentication bypass allowing arbitrary file upload in versions 3.14 and earlier to upload and execute a shell. Specifically, this targets /websitecode/php/import/import.php OPSEC This module results in directories being created and database entries which can not easily b...
CVE-2013-10034
An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and...
Kaseya KServer 安全漏洞
Kaseya KServer is a central server node for a management system from Kaseya Corporation, USA. A security vulnerability exists in Kaseya KServer versions prior to 6.3.0.2, which stems from an unauthenticated and uncleaned uploadImage.asp endpoint that could lead to arbitrary file uploads and remot...
CVE-2025-4370
The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on processexternalasseturls function as well as missing path validation in storefile function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated...
CVE-2025-54082 nova-tiptap has an Unauthenticated Arbitrary File Upload Vulnerability
marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...
CVE-2025-34111
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector connector.minimal.php, which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The...
WordPress Alone theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation vulnerability
Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation vulnerability discovered by Thái An in WordPress Theme Alone versions = 7.8.3...
Frappe Technologies Frappe 跨站脚本漏洞
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A cross-site scripting vulnerability exists in Frappe Technologies Frappe versions prior to 14.94.2 and prior to 15.57.0, which stems from an...
CVE-2025-34046 Fanwei E-Office Unauthenticated File Upload
An unauthenticated file upload vulnerability exists in the Fanwei E-Office = v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters uploadType=eofficelogo or...
Weaver E-Office 安全漏洞
Weaver E-Office is a collaborative office system from China's Panavision Technologies Weaver. A security vulnerability exists in Weaver E-Office v9.4 and prior versions, which originates from an unauthenticated file upload attack due to incorrect operation of the file /general/index/UploadFile.ph...