CVE-2025-23921 WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through = 1.1.3...

CVE-2025-23921

The vulnerability CVE-2025-23921 affects the WordPress plugin Multi Uploader for Gravity Forms (notFound) and is described as Unrestricted Upload of File with Dangerous Type, enabling uploading a web shell to the web server. Public details indicate the issue affects versions from an unspecified s...

WordPress plugin Multi Uploader for Gravity Forms 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

Exploit for Path Traversal in Wso2 Api_Manager

Exploit CVE-2022-29464 Este repositorio contiene un script pa...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Colin Xu in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.3...

WSO2 API Manager SynapseArtifactUploaderAdmin Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WSO2 API Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the SynapseArtifactUploaderAdmin endpoint, which listens on TCP port 9443 by default. The...

WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.6.9...

Malicious code in imgur-uploader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e12db7b7de507126d4fa046e84a7acb1e502c87e639c69d90159cd396bed2b84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11829 Malicious code in imgur-uploader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e12db7b7de507126d4fa046e84a7acb1e502c87e639c69d90159cd396bed2b84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hmp/h-image-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 393baa73357f44a746ebe45eb2d74ed46234f46c3cfc528b4d221c1e3f945626 The OpenSSF Package Analysis project identified '@hmp/h-image-uploader' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2024-11162 Malicious code in @hmp/h-image-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 393baa73357f44a746ebe45eb2d74ed46234f46c3cfc528b4d221c1e3f945626 The OpenSSF Package Analysis project identified '@hmp/h-image-uploader' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

CVE-2024-8873 PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting

The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-8873 PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting

The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrar...

WordPress plugin PeproDev WooCommerce Receipt Uploader 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Cross-site Scripting (XSS)

Overview sylius/sylius is a platform for PHP, based on Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a malicious SVG file, in ImageUploader.php. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects”...

Malicious code in byted-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18d8716f381fe415e0a60d91795ecdf5fd7e914d91f66bbee21945a374aa409f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10304 Malicious code in byted-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18d8716f381fe415e0a60d91795ecdf5fd7e914d91f66bbee21945a374aa409f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-VGXQ-6RCF-QWRW angular-base64-upload vulnerable to unauthenticated remote code execution

angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the...

WordPress AVIF & SVG Uploader plugin <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin AVIF & SVG Uploader versions = 1.1.0...

WordPress plugin AVIF & SVG Uploader 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...