CVE-2026-41269

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally...

EUVD-2005-1034

Malware in sbrugna...

CVE-2024-24827

Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to...

CVE-2022-28913

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

GHSA-VQQR-FGMH-F626 Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads

Impact Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. Patches Update to Contao 4.13.54, 5.3.30 or 5.5.6. Workarounds Remove svg,svgz from the allowed upload file types in the system settings and from contao.editablefiles in the config.yaml...

CVE-2023-30538 Stored Cross-site Scripting via improper sanitization of svg files in Discourse

Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitrary JavaScript on the users’ browsers by uploading a crafted SVG file. This issue is patched in the latest stable and tests-passed versions of Discourse. Use...

PT-2022-17696 · Modx · Modx Revolution

Name of the Vulnerable Software and Affected Versions: MODX Revolution versions 2.8.3-pl and earlier Description: The issue allows remote authenticated administrators to execute arbitrary code by uploading an executable file. This is possible because the Uploadable File Types setting can be chang...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

Belkin LINKSYS RE6500 Operating System Command Injection Vulnerability

The Belkin LINKSYS RE6500 is a wireless router from Belkin USA. An operating system command injection vulnerability exists in Belkin LINKSYS RE6500 devices prior to version 1.0.012.001, which allows a remote authenticated user to execute arbitrary commands to the upload settings.cgi page via shel...

PT-2018-3878 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G devices affected versions not specified Description: The issue is related to the lack of authentication in certain components of the D-Link DIR-823G device's firmware, specifically ExportSettings.sh, upload settings.cgi,...

WordPress Think Responsive Themes 1.0 - Arbitrary File Upload Vulnerability

No description provided by source. . . . \ \ | / \ \ \ | || / \ / / \ / |/ \ / | / \ / / /| | |/ \ \ \ // \ / / | \ /\ / | \ \ \ / \ //\ |\ | /\ // | /|\ / / / / / / / Exploit Title: WordPress Think Responsive Themes Arbitrary File Upload Vulnerability Author: Byakuya Date:...