CVE-2021-34685

UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed and leads to remote code...

CVE-2020-36082

File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to upload module...

CVE-2019-15314

tiki/tiki-uploadfile.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-downloadfile.php?display= URI...

CVE-2019-15524

CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI...

CVE-2025-4893

A vulnerability classified as critical has been found in jammy928 CoinExchangeCryptoExchangeJava up to 8adf508b996020d3efbeeb2473d7235bd01436fa. This affects the function uploadLocalImage of the file...

PT-2025-21777

Name of the Vulnerable Software and Affected Versions: The Echo RSS Feed Post Generator plugin for WordPress versions up to, and including, 5.4.8.1 Description: The issue is related to arbitrary file uploads due to missing file type validation in the echo generate featured image function. This...

CVE-2025-4291

IdeaCMS up to version 1.6 is affected by a vulnerability in the saveUpload function that allows unrestricted file uploads. The issue enables remote exploitation and has publicly disclosed exploit information. Connected sources corroborate the vulnerability in saveUpload and describe it as critica...

CVE-2025-4279

CVE-2025-4279 concerns the WordPress plugin “External image replace” (affected versions ≤ 1.0.8). The issue is an arbitrary file upload vulnerability caused by missing file-type validation in external_image_replace_get_posts::replace_post, allowing authenticated attackers with contributor-level p...

CVE-2025-4259

CVE-2025-4259 affects newbee-mall 1.0. The vulnerability resides in UploadController.java (Upload function) where manipulation of the File argument enables unrestricted file upload. The issue is exploitable remotely and, per sources, the exploit has been disclosed publicly. Connected documents co...

Exploit for CVE-2025-39538

🛡️ CVE-2025-39538 - WordPress WP-Advanced-Search = 3.3.9.3 Ar...

CVE-2025-3765

A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument Avatar leads to unrestricted upload. The attack may be...

CVE-2025-3807

A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/controller/common/UploadController.java of the component Endpoint. The manipulation leads to unrestricted upload. It is possible to initiate...

CVE-2025-3807

CVE-2025-3807 affects zhenfeng13 My-BBS 1.0, specifically the Upload function in src/main/java/com/my/bbs/controller/common/UploadController.java (Endpoint component). The vulnerability enables unrestricted file uploads and can be triggered remotely; exploits have been publicly disclosed. Connect...

CVE-2025-3593 ZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted upload

A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of the file /admin/upload/authorImg/. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely...

PT-2025-15353 · Unknown · Mymagicpower Aias

Name of the Vulnerable Software and Affected Versions: mymagicpower AIAS 20250308 Description: A critical issue was found in the code of the file training platform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java, affecting the File argument. This allows for...

CVE-2025-3327

A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely...

PT-2025-15286 · Zhangyanbo2007 · Youkefu

Name of the Vulnerable Software and Affected Versions: zhangyanbo2007 youkefu version 4.2.0 Description: A critical issue was found in the File Upload component, specifically affecting the WebIMController.java file. The manipulation of the ID argument leads to path traversal. This issue can be...

CVE-2025-3324 godcheese/code-projects Nimrod FileRestController.java unrestricted upload

A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotel...

Exploit for Unrestricted Upload of File with Dangerous Type in Etoilewebdesign Front_End_Users

WordPress FEUP Arbitrary File Upload Exploit CVE-2025-2005 T...

CVE-2025-2973

A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/student.php. The manipulation of the argument profileimage leads to unrestricted upload. It is possible to initiate the attack remotely. The...