EUVD-2025-3976

Malicious code in bioql PyPI...

MAL-2025-34011 Malicious code in strapi-upload-aws-s3 (npm)

The package strapi-upload-aws-s3 was found to contain malicious code...

CVE-2025-8729 MigoXLab LMeterX upload_service.py process_cert_files path traversal

A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function processcertfiles of the file backend/service/uploadservice.py. The manipulation of the argument taskid leads to path traversal. The attack can be launched remotely...

CVE-2025-8729 MigoXLab LMeterX upload_service.py process_cert_files path traversal

A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function processcertfiles of the file backend/service/uploadservice.py. The manipulation of the argument taskid leads to path traversal. The attack can be launched remotely...

LMeterX 路径遍历漏洞

LMeterX is an open source professional load testing program for any LLM API by MigoXLab. A path traversal vulnerability exists in LMeterX version 1.2.0, which stems from incorrect manipulation of the parameter taskid in the file backend/service/uploadservice.py resulting in path traversal...

PT-2025-32358 · Migoxlab · Lmeterx

Name of the Vulnerable Software and Affected Versions: MigoXLab LMeterX version 1.2.0 Description: A vulnerability exists in MigoXLab LMeterX 1.2.0 related to path traversal. The process cert files function within the backend/service/upload service.py file is affected. Manipulation of the task id...

CVE-2025-53709 Access control issues impacting secure-upload service

Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments. Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily...

CVE-2025-53709 Access control issues impacting secure-upload service

Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments. Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily...

CVE-2025-53709

The CVE-2025-53709 entries describe a privilege/authorization issue in Palantir Secure-upload, a data submission service installed on a limited set of environments. Affected component: Secure-upload before version 0.815.0. Reported problems include: privileged users could select email templates n...

CVE-2025-6108 hansonwang99 Spring-Boot-In-Action File Upload ImageUploadService.java watermarkTest path traversal

A vulnerability was found in hansonwang99 Spring-Boot-In-Action up to 807fd37643aa774b94fd004cc3adbd29ca17e9aa. It has been declared as critical. Affected by this vulnerability is the function watermarkTest of the file...

CVE-2025-6108

Vulnerability CVE-2025-6108 affects hansonwang99 Spring-Boot-In-Action up to a specific commit. The path-traversal flaw is in the watermarkTest function of ImageUploadService.java under the File Upload component, allowing remote exploitation. Multiple sources confirm the issue and public disclosu...

PT-2025-25519 · Unknown · Spring-Boot-In-Action

Name of the Vulnerable Software and Affected Versions: hansonwang99 Spring-Boot-In-Action up to 807fd37643aa774b94fd004cc3adbd29ca17e9aa Description: A critical issue was found in the function watermarkTest of the file /springbt watermark/src/main/java/cn/codesheep/springbt...

CVE-2022-41870

AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app upload...

CVE-2023-28158

Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user...

The vulnerability of the processAnalyticsReport method of the com.webos.service.cloudupload service in the LG WebOS operating system allows a hacker to elevate their privileges to the root level.

The vulnerability of the processAnalyticsReport method of the com.webos.service.cloudupload service in the LG WebOS operating system exists because measures to neutralize the special elements used in the operating system commands have not been taken. Exploiting this vulnerability allows a malicio...

CVE-2023-6318

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger...

Path traversal

In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote attackers to write to arbitrary files via a crafted filename parameter in requests to the /upload endpoint...

PT-2023-2336 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva affected versions not specified Description: The issue is related to privilege escalation via stored cross-site scripting XSS using the file upload service to upload malicious content. This can be exploited by authenticated use...

CVE-2021-34685

UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed and leads to remote code...

Pentaho Business Analytics / Pentaho Business Server 9.1 Filename Bypass

Product: Pentaho Business Analytics / Pentaho Business Server Vendor / Manufacturer: Hitachi Vantara Affected Versions: = 9.1 Vulnerability Type: Bypass of Filename Extension Restrictions Solution Status: Fix Released on public GitHub repository Manufacturer Notification: June 2021 Public...