CVE-2025-57460

MachSol MachPanel 8.0.32 is affected by a file upload vulnerability that enables an attacker to gain a webshell. The Red Hat, ENISA, NVD, CNNVD, CVE records concur on the issue being a file upload flaw in MachPanel 8.0.32, with high impact (C/H/I/A) and network access. Root cause is described as ...

CVE-2024-25182

Affected software: givanz VvvebJs 1.7.2. The CVE describes a file upload vulnerability via save.php, with a CVSS v3.1 base score of 9.8 (CRITICAL), attack vector NETWORK, no user interaction, and impact to confidentiality, integrity, and availability (H, H, H). Root cause is a file upload flaw in...

CVE-2025-57460

File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell...

CVE-2025-15152 h-moses moga-mall PmsProductController.java addProduct unrestricted upload

A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the file src/main/java/com/ms/product/controller/PmsProductController.java. Such manipulation of the argument objectName leads to unrestricted...

PT-2025-53644

Name of the Vulnerable Software and Affected Versions ChenJinchuang Lin-CMS-TP5 versions up to 0.3.3 Description A flaw exists in ChenJinchuang Lin-CMS-TP5 that allows for remote code injection. The issue is located in the Upload function within the LocalUploader.php file of the File Upload Handl...

CVE-2025-15110 jackq XCMS Backend ProductImageController.class.php upload unrestricted upload

A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/ProductImageController.class.php of the component Backend. Such manipulation of the argument File leads to unrestricted upload. It is...

Improper Protection of Alternate Path

Overview Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to insufficient validation in attachment editing APIs. An attacker can upload files with restricted extensions by modifying the attachment name, leading to unauthorized file uploads and further...

Kentico Xperience File Upload Vulnerability

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a file upload vulnerability that stems from a lack of valid validation of uploaded files in the MVC form file upload component. The vulnerability can be exploited to remotely execute arbitrary code by...

EUVD-2023-60233

WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file pa...

CVE-2023-53971

WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file pa...

CVE-2025-15009

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launche...

CVE-2025-67288

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation as shown in the documentation belongs to the system administrator who is...

webTareas 代码问题漏洞

webTareas is a web-based open source collaboration tool for luiswang individual developers. The product supports project management, bug tracking, content management and meeting management. A code issue vulnerability exists in webTareas version 2.4, which stems from a file upload feature that cou...

CVE-2025-14965

A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/delete of the file src/main/java/per/ccm/ygmall/extra/controller/ResourceController.java. Performing manipulation results in path traversal. This product is using ...

CVE-2023-53952

Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attackers can upload files containing PHP system commands that execute when the uploaded file is accessed...

CVE-2025-14965 1541492390c yougou-mall ResourceController.java delete path traversal

A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/delete of the file src/main/java/per/ccm/ygmall/extra/controller/ResourceController.java. Performing manipulation results in path traversal. This product is using ...

EUVD-2025-204533

Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormDatacontentType =...

CVE-2025-66908

Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) has an improper file type validation in the OCR image upload feature. The OcrController relies on client-provided Content-Type headers and file extensions, without validating file content via magic bytes. This can enable uploading arbitrary f...

turms 安全漏洞

turms is an instant messaging engine from turms-im open source. A security vulnerability exists in turms AI-Serving module v0.10.0-SNAPSHOT and prior versions, which stems from improper file type validation in the OCR image upload feature and could lead to server-side code execution...

CVE-2023-53921

SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory. Attackers can upload a .phar file with system command execution payload to compromise the web application and execute arbitrary system commands...