PT-2025-15941 · Unknown · Labcat Processing Projects

Name of the Vulnerable Software and Affected Versions: LABCAT Processing Projects versions 1.0.0 through 1.0.2 Description: The issue allows an attacker to upload a web shell to a web server, potentially leading to unauthorized access and control. This is due to an unrestricted upload of files wi...

CVE-2025-3115

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code...

CVE-2025-3115

CVE-2025-3115 involves TIBCO Spotfire data functions with injection vulnerabilities and insufficient validation of filenames during file uploads, enabling potential arbitrary code execution. Connected sources indicate this is a high-severity issue (CVSS 3.1/4.0, CRITICAL) affecting Spotfire compo...

CVE-2025-3115 Spotfire Data Function Vulnerability

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code...

GO-2025-3594 MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio

MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio...

CVE-2025-3100

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

CVE-2025-3100

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

CVE-2025-3100

CVE-2025-3100 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WP Project Manager plugin for WordPress. The issue arises from insufficient input sanitization and output escaping in the tasks discussion, enabling an authenticated user with Subscriber-level access (and those grant...

CVE-2025-3100: Improper Neutralization of Input During Web Page Generation

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

PT-2025-15671 · WordPress · Wp Project Manager

Name of the Vulnerable Software and Affected Versions: The WP Project Manager plugin versions up to, and including, 2.6.22 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping in tasks discussion. This...

PT-2025-15720 · Squeeze · Squeeze

Name of the Vulnerable Software and Affected Versions: Bogdan Bendziukov Squeeze versions n/a through 1.6 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 1.6, consider restricti...

PT-2025-15701 · Verydows · Verydows

Name of the Vulnerable Software and Affected Versions: verydows version 2.0 Description: The issue is related to insecure permissions, allowing a remote attacker to execute arbitrary code by uploading a specific file type. This can be achieved through the action of loading a particular type of...

Reliance on File Name or Extension of Externally-Supplied File

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Reliance on File Name or Extension of Externally-Supplied File when handling uploaded files in FileSystem/FileManager.cs and...

tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be...

CVE-2025-2525

The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'stAuthenticationController::editprofile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above...

CVE-2025-2525

The CVE-2025-2525 entry concerns the WordPress Streamit theme. Public detail confirms an Arbitrary File Upload flaw caused by missing file-type validation in st_Authentication_Controller::edit_profile, affecting all versions up to 4.0.1. The vulnerability requires authentication at Subscriber lev...

CVE-2025-32369

Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content for stored XSS via certain interactions with the media library file upload feature...

PT-2025-15465 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 10.0.3 Description: The issue is related to the save function in HAXCMSFile.php, which allows for unrestricted file uploads due to a non-exhaustive denylist. This list only blocks files with .php, .sh, .js, and...

AIAS 安全漏洞

AIAS is an AI one-stop solution from Calvin Personal Developer. A security vulnerability exists in AIAS version 20250308, which stems from the fact that incorrect manipulation of the parameter File can lead to unrestricted uploads...

PT-2025-15470

Name of the Vulnerable Software and Affected Versions: AOS-10 GW affected versions not specified AOS-8 Controller/Mobility Conductor affected versions not specified Description: Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8...