CVE-2024-56057

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through 1.9.9.5.2...

CVE-2024-56054

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through 1.9.9.5.2...

CVE-2024-47319

Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form bit-form.This issue affects Bit Form: from n/a through = 2.13.10...

CVE-2024-49260

Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through = 1.5.7...

CVE-2024-51748

Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting applicationlanguage in the...

CVE-2024-6123

The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload...

Checkmk 2.3.0p2 / NagVis 1.9.40 Shell Upload Vulnerability

Title: Checkmk NagVis Remote Code Execution Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2025-002.txt 1. Vulnerability Details Affected Vendor: Checkmk Affected Product: Checkmk/NagVis Affected Version: Checkmk 2.3.0p2, NagVis 1.9.40 Platform: GNU/Linux CWE Classification:...

CVE-2024-35746

Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover: from n/a through 2.1.4.2...

CVE-2024-57968

CVE-2024-57968 affects Advantive VeraCore (pre-2024.4.2.1). It is an unrestricted file upload vulnerability that allows a remote authenticated user to upload files to unintended folders (upload.aspx). VeraCore was patched in version 2024.4.2.1. In practice, multiple sources flag active exploitati...

PT-2025-2194 · WordPress · The Shared Files – Frontend File Upload Form & Secure File Sharing

Name of the Vulnerable Software and Affected Versions: The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress versions up to, and including, 1.7.42 Description: The issue is related to Stored Cross-Site Scripting via dfxp File uploads due to insufficient input...

CVE-2025-24650 WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through = 2.15.3...

CVE-2025-23953 WordPress user files plugin <= 2.4.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects user files: from n/a through = 2.4.2...

CVE-2025-23953

CVE-2025-23953 describes an Unrestricted Upload of File with Dangerous Type in the WordPress plugin named user files , allowing an attacker to upload a Web Shell to the Web Server. Affected software is listed as the WordPress plugin user files , with versions up to 2.4.2 (no fixed version provide...

Authenticated Stored XSS in YesWiki

Authenticated Stored XSS in YesWiki wiki-href'upload', $this-wiki-GetPageTag, "file=$this-file" . '" class="btn btn-primary" ' . t'UPLOADFILE' . ' ' . $this-file . ''; The file name attribute is not properly sanitized when returned to the client, therefore allowing the execution of malicious...

CVE-2024-12427

The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fwuploadfile AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as imag...

CVE-2025-22782

CVE-2025-22782 affects WR Price List Manager For Woocommerce (WordPress). Unrestricted file upload of dangerous types (authenticated) allows uploading a web shell to the web server, with CVSS 3.1 vector NETWORK/LOW/LOW/UI:N/S:C/C:H/I:H/A:H and a 9.9 base score. Wordfence listing shows this vulner...

PT-2025-1274

Name of the Vulnerable Software and Affected Versions SimpleHelp remote support software versions 5.5.7 and before Description The issue allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file, also known as a zip slip. This can be exploited to...

CVE-2024-50859

The ipimportaclcsv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data...

CVE-2024-50859

The ipimportaclcsv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data...

Wavlink AC3000 fw_check.sh Firmware Upload vulnerability

Talos Vulnerability Report TALOS-2024-2037 Wavlink AC3000 fwcheck.sh Firmware Upload vulnerability January 14, 2025 CVE Number CVE-2024-39273 SUMMARY A firmware update vulnerability exists in the fwcheck.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can...