CVE-2025-66480 Wildfire has Arbitrary File Upload via Directory Traversal in UploadFileAction

Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists in the im-server component related to the file upload functionality found in com.xiaoleilu.loServer.action.UploadFileAction. The application exposes an endpoint /fs that handles...

CVE-2025-66480

CVE-2025-66480 concerns Wildfire IM’s im-server, where the UploadFileAction (endpoint /fs) mishandles uploaded filenames. The writeFileUploadData logic directly concatenates the configured storage directory with the uploaded filename without stripping directory traversal sequences (e.g., ../../),...

PT-2024-29351

Name of the Vulnerable Software and Affected Versions WonderCMS version 3.4.3 Description The issue is related to an arbitrary file upload vulnerability in the uploadFileAction function. This allows attackers to execute arbitrary code via a crafted SVG file. There is no information provided about...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2024-41304: Improper Control of Generation of Code

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2018-1000062

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction, 'svg' = 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG...

PT-2018-9248

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.4.0 Description: The issue allows an attacker to execute arbitrary script on an unsuspecting user's browser through a Stored Cross-Site Scripting vulnerability in the file upload functionality. This is achieved by exploiti...

CVE-2018-1000062: Improper Neutralization of Input During Web Page Generation

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction, 'svg' = 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG...

Oracle Application Testing Suite UploadFileAction Servlet Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Application Testing Suite. Authentication is required but can be bypassed. The specific vulnerability is in the UploadFileAction servlet. By providing a fileType parameter of "", an attacker...

CVE-2016-0491

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from...

PT-2016-4251

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Grid Control versions 12.4.0.2 through 12.5.0.2 Description The issue affects the integrity and availability of the system, allowing remote attackers to exploit it via unknown vectors related to Load Testing for Web...