9461 matches found
WordPress plugin Instantio 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...
PT-2025-19928 · Unknown · Production Ssm +1
Name of the Vulnerable Software and Affected Versions: feng ha ha/megagao ssm-erp and production ssm version 0.0.1 Description: A critical issue affects the uploadFile function in the file src/main/java/com/megagao/production/ssm/service/impl/FileServiceImpl.java. The manipulation of the uploadFi...
itsourcecode Content Management System 安全漏洞
itsourcecode Content Management System is an open source content management system from itsourcecode. A security vulnerability exists in version 1.0 of itsourcecode Content Management System, which originates from an improper operation of the parameter Cover Image in the file /admin/addtopic.php,...
Netoloji E-Flow 代码问题漏洞
Netoloji E-Flow is an application from the Turkish company Netoloji. A code issue vulnerability exists in Netoloji E-Flow versions prior to 3.23.00, which stems from an unrestricted upload of dangerous types of files and improper input neutralization during web page generation, which could lead t...
ssm-erp 安全漏洞
ssm-erp is a production management ERP system by fenghaha individual developer. A security vulnerability exists in ssm-erp 0.0.1 and earlier versions, which stems from the mishandling of the parameter uploadFile by the function uploadFile, which could lead to arbitrary file uploads...
CVE-2025-4279
The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'externalimagereplacegetposts::replacepost' function in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with...
CVE-2025-28168
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension...
Open WebUI 跨站脚本漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in versions of Open WebUI prior to 0.6.6, which stems from a low-privileged user being able to upload HTML files containing JavaScript code, which...
newbee-mall 代码问题漏洞
newbee-mall is a newbee open source e-commerce system. A code issue vulnerability exists in version 1.0 of newbee-mall, which stems from improper handling of the parameter File in the file ltd/newbee/mall/controller/common/UploadController.java, which could lead to arbitrary file uploads...
WordPress plugin External image replace 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...
youkefu 代码问题漏洞
youkefu is a customer service support application by the individual developer zhangyanbo2007. A code issue vulnerability exists in youkefu 4.2.0 and earlier versions, which originates from the file youkefu-mastersrcmainjavacomukefuwebimwebhandler. Mishandling of the parameter imgFile in...
OutSystems Multiple File Upload 安全漏洞
OutSystems Multiple File Upload is a native multiple file upload component for the OutSystems platform from OutSystems, Inc. A security vulnerability exists in OutSystems Multiple File Upload versions prior to 3.1.0 that stems from insufficient client-side authentication could result in the uploa...
CVE-2024-13418
Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that c...
CVE-2024-13418
CVE-2024-13418 is tied to WordPress ecosystems where multiple plugins/themes (notably the Smart Framework family: Benaa, April, Beyot, Auteur; and related plugins) expose an Arbitrary File Upload vulnerability via a missing capability check in ajaxUploadFonts(). The issue allows authenticated att...
CVE-2025-1305
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsbloggerinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...
CVE-2025-1304
The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsbloggerinstallandactivateplugin function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and...
PT-2025-18353 · WordPress · Newsblogger
Name of the Vulnerable Software and Affected Versions: NewsBlogger theme for WordPress versions up to, and including, 0.2.5.1 Description: The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger install and activate plugin...
WordPress plugin NewsBlogger 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerabilit...
Elastic Kibana 安全漏洞
Elastic Kibana is an available data visualization dashboard software from Elastic, Inc. A security vulnerability exists in Elastic Kibana versions prior to 8.12.0, which stems from an unrestricted upload of a dangerous type of file and could lead to the execution of arbitrary JavaScript in a...