CVE-2025-1662 URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'urlmediauploaderurlupload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrar...

CVE-2025-1662

CVE-2025-1662 is an SSRF flaw in the WordPress plugin URL Media Uploader (

WordPress plugin URL Media Uploader 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-9081 · WordPress · Url Media Uploader

Name of the Vulnerable Software and Affected Versions: URL Media Uploader plugin for WordPress versions prior to 1.1.0, or more specifically, version 1.0.0 and earlier Description: The issue allows authenticated attackers with author-level access and above to perform Server-Side Request Forgery v...

WordPress URL Media Uploader plugin <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding vulnerability

Authenticated Author+ Server-Side Request Forgery via DNS Rebinding vulnerability discovered by ch4r0n in WordPress Plugin URL Media Uploader versions = 1.0.0...

Arbitrary File Upload

Overview streamlit is a The fastest way to build data apps in Python Affected versions of this package are vulnerable to Arbitrary File Upload in the fileuploader.py widget, which does not enforce uploaded file type restrictions on the server side, even if they are set in the client. Remediation...

CVE-2024-57082

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@djangocfg/ui-nextjs (>=2.1.91 <=2.1.101), @djangocfg/ui-tools (>=2.1.162 <=2.1.431) +29 more potentially affected by CVE-2024-57082 via @rpldy/uploader (>=0.10.0 <=1.9.0)

@rpldy/uploader NPM version =0.10.0, =2.1.91, =2.1.162, =0.0.70, =0.1.77, =0.1.7, =0.1.5, =0.4.0, =0.5.0, =0.1.6, =0.1.7, =0.1.4, =0.2.0, =0.1.4, =0.1.5, =0.11.0, =1.13.0 and more Source cves: CVE-2024-57082 Source advisory: OSV:GHSA-PC47-G7GV-4GPW...

GHSA-PC47-G7GV-4GPW @rpldy/uploader prototype pollution

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@rpldy/uploader prototype pollution

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57082

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2020-5237

Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem potentially leading to arbitrary code execution via the 1 filename parameter to BlueimpController.php; the 2 dzchunkindex...

CVE-2024-57082

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57082

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

PT-2025-5758 · Npm · @Rpldy/Uploader

Name of the Vulnerable Software and Affected Versions: @rpldy/uploader version 1.8.1 Description: A prototype pollution in the lib.createUploader function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For @rpldy/uploader version 1.8.1, conside...

CVE-2024-13720

The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gkyimageuploadermainfunction function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to delete arbitrary files on...

CVE-2025-24574

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through =...

WordPress plugin PeproDev WooCommerce Receipt Uploader 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-5415 · Peprodev · Peprodev Woocommerce Receipt Uploader

Name of the Vulnerable Software and Affected Versions: PeproDev WooCommerce Receipt Uploader versions prior to 2.6.9 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject...

CVE-2024-13720

The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gkyimageuploadermainfunction function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to delete arbitrary files on...