461 matches found
EUVD-2023-23951
Malicious code in bioql PyPI...
EUVD-2025-8011
Malicious code in bioql PyPI...
CVE-2025-10398
A security flaw has been discovered in fcbazzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils.java. The manipulation of the argument File results in unrestricted upload. The attack can be launched remotely. The exploit has been...
CVE-2012-10027 WordPress Plugin WP-Property <= 1.35.0 PHP File Upload
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party uploadify.php script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution...
PT-2025-31972 · Unknown · Writebot Ai Content Generator Saas React Template
Name of the Vulnerable Software and Affected Versions: Writebot AI Content Generator SaaS React Template versions through 4.0.0 Description: A file upload issue exists in Writebot AI Content Generator SaaS React Template. Remote attackers can exploit this to gain escalated privileges by submittin...
CVE-2025-41396
A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user...
CVE-2014-125115 Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE
An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhashdata parameter, allowing attackers to extract administrator credentials or active session tokens via crafted...
Denial Of Service (DoS)
Starlette is vulnerable to Denial Of Service DoS. The vulnerability is due to blocking of the main event thread caused by improper handling of large multipart file uploads, where a bug in the UploadFile logic fails to anticipate memory rollover, blocking the application from accepting new...
CVE-2025-54121
CVE-2025-54121 affects Starlette (Python, ASGI). In versions 0.47.1 and older, multipart form parsing of large files can cause the main event loop to stall while rolling the file to disk, because UploadFile incorrectly checks file-in-memory status and whether additional bytes trigger a rollover. ...
PT-2025-30346 · Unknown · Jpacookieshop
Name of the Vulnerable Software and Affected Versions: jerryshensjf JPACookieShop 蛋糕商城JPA版 version 1.0 Description: A critical issue exists in the addGoods function within the GoodsController.java file, allowing for unrestricted file uploads. This issue is remotely exploitable. Recommendations: A...
CVE-2025-53925
CVE-2025-53925 affects Emlog up to version 2.5.17. A cross-site scripting (XSS) flaw exists in the file upload functionality that lets an authenticated user upload an SVG containing JavaScript, which can be executed in the victim’s context. The root cause is insufficient handling/cleanup of uploa...
CVE-2025-48300 WordPress Groundhogg plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg groundhogg allows Upload a Web Shell to a Web Server.This issue affects Groundhogg: from n/a through = 4.2.1...
PT-2025-29801 · Unknown · Groundhogg
Name of the Vulnerable Software and Affected Versions: Groundhogg versions through 4.2.1 Description: Groundhogg is susceptible to an unrestricted file upload issue that allows for the upload of a web shell to a web server. Recommendations: Update Groundhogg to a version later than 4.2.1...
PT-2025-29546 · Matomo · Matomo
Name of the Vulnerable Software and Affected Versions: Matomo versions prior to 3.0.3 Description: An authenticated remote code execution issue exists in Matomo due to the plugin upload mechanism. An authenticated user with Superuser privileges can upload and activate a malicious plugin ZIP...
PT-2025-29343 · Unknown · Joeybling Springboot Mybatisplus
Name of the Vulnerable Software and Affected Versions: JoeyBling SpringBoot MyBatisPlus versions prior to a6a825513bd688f717dbae3a196bc9c9622fea26 Description: A critical vulnerability exists in the SysFileController function located at /file/upload within JoeyBling SpringBoot MyBatisPlus...
CVE-2025-34097
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install...
CVE-2025-7362
The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload...
CVE-2025-7362
Summary : CVE-2025-7362 affects the MediaWiki MsUpload extension. Affected versions are 1.39.X (before 1.39.13), 1.42.X (before 1.42.7), and 1.43.X (before 1.43.2). The issue is a stored XSS in the msu-continue system message that is inserted into the DOM without proper sanitization, occurring in...
CVE-2025-30933
CV E-2025-30933 (LogisticsHub) in WordPress LogisticsHub theme (versions <= 1.1.6) has an Unrestricted Upload of File with Dangerous Type vulnerability that allows uploading a web shell to the web server. The weakness affects the plugin/theme in the LogisticsHub line and is currently unpatched...