315 matches found
EUVD-2025-25433
Malicious code in bioql PyPI...
EUVD-2023-0296
Malicious code in bioql PyPI...
EUVD-2024-52654
Malicious code in bioql PyPI...
EUVD-2022-35228
Malicious code in bioql PyPI...
EUVD-2025-32247
The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpdispatcherprocessupload function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
CVE-2025-10058
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadfunction function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with...
CVE-2025-10058 WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadfunction function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with...
CVE-2025-55383
Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files of any extension to any location on the target server...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the upload function configuration. An attacker can write arbitrary files with any extension to any location on the target server by uploading crafted files. Remediation There is no fixed version for...
CVE-2025-55383
Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files of any extension to any location on the target server...
CVE-2025-8841
A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The manipulation leads to unrestricted upload. The attack can be...
CVE-2025-8841
CVE-2025-8841 affects zlt2000 microservices-platform up to version 6.0.0. The vulnerability resides in the Upload function of zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java and enables unrestricted file uploads. Attack can be launched remotely, and public d...
CVE-2025-8750 macrozheng mall Add Product Page upload cross site scripting
A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Affected by this vulnerability is the function Upload of the file /minio/upload of the component Add Product Page. The manipulation of the argument File leads to cross site scripting. The attack can be...
CVE-2025-6282
A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function createuploadfile of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the publ...
PT-2025-26246 · Unknown · Xlang-Ai Openagents
Name of the Vulnerable Software and Affected Versions: xlang-ai OpenAgents versions up to ff2e46440699af1324eb25655b622c4a131265bb Description: A critical issue was found in the create upload file function of the backend/api/file.py file, leading to path traversal. The exploit has been disclosed ...
CVE-2024-50348
InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS Cross Site Scripting payload and execute. This vulnerability is fixed in 2.16.3...
CVE-2024-9903
A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The...
CVE-2024-54730
Flatnotes...