CVE-2025-15110

The CVE describes a flaw in jackq XCMS Backend where the Upload function in Admin/Home/Controller/ProductImageController.class.php mishandles the File argument, enabling unrestricted remote file uploads. Multiple sources confirm the affected component and argue that manipulating the File paramete...

CVE-2025-9406 xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

CVE-2025-2208

A vulnerability, which was classified as problematic, has been found in aitangbao springboot-manager 3.0. This issue affects some unknown processing of the file /sysFiles/upload of the component Filename Handler. The manipulation of the argument name leads to cross site scripting. The attack may ...