CVE-2024-50348

InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS Cross Site Scripting payload and execute. This vulnerability is fixed in 2.16.3...

CVE-2024-9903

A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The...

CVE-2024-54730

Flatnotes...

CVE-2024-54687

Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting XSS via the Documents module and function uploadAndSaveFile in CRMEntity.php...

CVE-2022-30013

A stored cross-site scripting XSS vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file...

CVE-2022-44942

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function...

CVE-2022-25574

A stored cross-site scripting XSS vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file...

CVE-2022-34025

Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...

CVE-2022-2049

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

CVE-2020-19914

Cross Site Scripting XSS in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function...

PT-2025-21631 · Unknown · Production Ssm +1

Name of the Vulnerable Software and Affected Versions: feng ha ha/megagao ssm-erp version 1.0 production ssm version 1.0 Description: A critical vulnerability has been found in the affected software, affecting the uploadPicture function of the PictureServiceImpl.java file. The manipulation of the...

DumbDrop 跨站脚本漏洞

DumbDrop is a DumbWare open source application. A cross-site scripting vulnerability exists in versions prior to DumbDrop db27b25, which stems from a DOM cross-site scripting vulnerability in the upload function...

PT-2025-18766 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: Buddyboss Platform plugin for WordPress versions prior to 2.8.51 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the bp nouveau ajax media save function. This allo...

CVE-2025-29454

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function...

CVE-2025-3842

A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. This issue affects the function uploadUserPic.action of the file src/com/phn/action/FileUpload.java. The manipulation of the argument fileUpload leads to code injection. The attack may be initiated remotely. The exploi...

PT-2025-17412 · Unknown · Kuangsimplebbs

Name of the Vulnerable Software and Affected Versions: KuangSimpleBBS version 1.0 Description: A critical vulnerability has been found in KuangSimpleBBS, affecting the fileUpload function in the QuestionController.java file. The manipulation of the editormd-image-file argument leads to unrestrict...

My-BBS 安全漏洞

My-BBS is a SpringBoot + Mybatis + Thymeleaf technology implemented BBS forum system by ZHENFENG13 individual developer. There is a security vulnerability in My-BBS version 1.0, which originates from the function Upload in the file src/main/java/com/my/bbs/controller/common/UploadController.java,...

CVE-2025-29454

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function...

CVE-2025-29454

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function...