CVE-2025-15110

The CVE describes a flaw in jackq XCMS Backend where the Upload function in Admin/Home/Controller/ProductImageController.class.php mishandles the File argument, enabling unrestricted remote file uploads. Multiple sources confirm the affected component and argue that manipulating the File paramete...

CVE-2025-9406

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

CVE-2025-9406

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

CVE-2025-9406 xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

CVE-2025-2208

A vulnerability, which was classified as problematic, has been found in aitangbao springboot-manager 3.0. This issue affects some unknown processing of the file /sysFiles/upload of the component Filename Handler. The manipulation of the argument name leads to cross site scripting. The attack may ...

PT-2024-38676

Name of the Vulnerable Software and Affected Versions DedeBIZ version 6.3.0 Description A critical vulnerability was found in DedeBIZ, affecting the function get mime type of the file /admin/dialog/select images post.php in the component Attachment Settings. The manipulation of the argument uploa...

PT-2023-27854 · Byzoro · Byzoro Smart S85F Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S85F Management Platform versions up to 20230722 Description: A critical issue has been found, allowing for unrestricted upload through the manipulation of the file upload argument. This can be exploited remotely. The vendor was...

CVE-2023-3836: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePointaddImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated...

PT-2023-6727 · Dahua · Dahua Smart Parking Management

Name of the Vulnerable Software and Affected Versions: Dahua Smart Park Management versions up to 20230713 Description: The issue is related to an unrestricted file upload vulnerability in the /emap/devicePoint addImgIco?hasSubsystem=true file, which can be exploited remotely. This vulnerability...