fusionforge 安全漏洞

FusionForge is a suite of collaborative team development tools. The product includes features such as online communication, bug tracking and project management. A security vulnerability exists in versions prior to fusionforge 5.3+20140506, which stems from an Apache configuration that allows...

PT-2025-26592 · Innoshop · Innoshop

Name of the Vulnerable Software and Affected Versions: Innoshop versions 0.4.1 and earlier Description: The issue allows an authenticated attacker to achieve code execution on the server by exploiting the File Manager functions in the admin panel. This is done by uploading a crafted file and then...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Do not flush non-uploaded STAs. If the STA state is pre-moved to AUTHORIZED such as in IBSS scenarios, and the insertion attempt fails, the station is freed. In this case, the driver never knew about the station;...

GHSA-RH67-4C8J-HJJH Nautobot may allows uploaded media files to be accessible without authentication

Impact Files uploaded by users to Nautobot's MEDIAROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by...

FreeScout Cross-Site Scripting Vulnerability (CNVD-2025-20785)

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a cross-site scripting vulnerability that is caused by improper validation of user-supplied input in an uploaded HTML file. No detailed vulnerability...

Improper File Validation

umbraco.cms is vulnerable to improper file validation. The vulnerability is due to insufficient checks on uploaded file extensions, allowing bypass of configured restrictions via manipulated API requests...

Gokapi 安全漏洞

Gokapi is a lightweight self-hosted Firefox sending alternative by Marc Bulling, a personal developer. A security vulnerability exists in Gokapi versions prior to 2.0.0, which stems from the fact that embedded JavaScript code in uploaded filenames may lead to a stored cross-site scripting attack...

FreeScout 跨站脚本漏洞

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a cross-site scripting vulnerability that is caused by improper validation of user-supplied input in an uploaded HTML file. No detailed vulnerability...

CVE-2025-5299

A vulnerability was found in SourceCodester Client Database Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /userordercustomerupdate.php. The manipulation of the argument uploadedfilecancelled leads to unrestricted upload. The attack ca...

SourceCodester Client Database Management System 代码问题漏洞

SourceCodester Client Database Management System is a SourceCodester open source client database management system. A code issue vulnerability exists in SourceCodester Client Database Management System version 1.0, which stems from improper handling of the uploadedfilecancelled parameter in the...

CVE-2024-7579

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os...

CVE-2024-25801

SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name not the content of a file...

CVE-2024-3870

The Contact Form 7 Database Addon – CFDB7 plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6.8 via the cfdb7beforesendmail function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable...

CVE-2024-4266

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handlefile' function. This can allow unauthenticated attackers to extract sensitive data, such as...

CVE-2024-3318

A file path traversal vulnerability was identified in the DelimitedFileConnector Cloud Connector that allowed an authenticated administrator to set arbitrary connector attributes, including the “file“ attribute, which in turn allowed the user to access files uploaded for other sources...

CVE-2023-28476

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files...

CVE-2023-32689

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server vi...

CVE-2022-36677

Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document...

CVE-2022-29001

In SpringBootMovie =1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability...

CVE-2021-22796

A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolkit V1.15.9 and prior, C-Gate Server V2.11.7 and prior...