PT-2025-2645 · Unknown · Themeglow Jobboard

Name of the Vulnerable Software and Affected Versions: ThemeGlow JobBoard Job listing versions 1.2.6 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited by uploading a...

My-Blog 代码问题漏洞

My-Blog is a Java blog system implemented by SpringBoot + Mybatis + Thymeleaf and other technologies, with beautiful pages, full functionality, easy deployment and perfect code. A code issue vulnerability exists in My-Blog version 1.0, which stems from improper handling of the file parameter,...

PT-2025-4294 · Unknown · Langchain4J-Aideepin

Name of the Vulnerable Software and Affected Versions: LangChain4j-AIDeepin versions prior to 3.5.0 Description: LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to version 3.5.0, it used MD5 to hash files, which may cause file upload conflicts. Recommendations: For...

My-Blog 代码问题漏洞

My-Blog is a Java blog system implemented by SpringBoot + Mybatis + Thymeleaf and other technologies, with beautiful pages, full functionality, easy deployment and perfect code. A code issue exists in My-Blog version 1.0, which stems from an incorrect operation of the parameter editormd-image-fil...

studentmanager 代码问题漏洞

studentmanager is a student management system by the individual developers of ZeroWdd. A code issue vulnerability exists in studentmanager version 1.0, which stems from the parameter file in the file src/main/Java/com/wdd/studentmanager/controller/TeacherController.java that can lead to...

studentmanager 代码问题漏洞

studentmanager is a student management system by the individual developers of ZeroWdd. A code issue vulnerability exists in studentmanager version 1.0, which stems from the parameter file in the file src/main/Java/com/wdd/studentmanager/controller/StudentController.java that can lead to...

Mysiteforme 代码问题漏洞

Mysiteforme is a permission management system for wangl1989 individual developers. A code issue vulnerability exists in Mysiteforme version 1.0, which stems from the parameter test in the file src/main/java/com/mysiteform/admin/service/ipl/LocalUploadServiceImpl that can lead to unrestricted...

CVE-2025-1385

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

CVE-2025-22388

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting XSS vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or...

CVE-2025-22388

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting XSS vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or...

Campcodes Project Management System 代码问题漏洞

Campcodes Project Management System is a project management system from Campcodes, Inc. A code issue vulnerability exists in Campcodes Project Management System version 1.0, which stems from the parameter file in the file /forms/updateforms.php?action=changepic2&id=4 that can lead to unrestricted...

CVE-2025-22389

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by...

CVE-2025-22388

A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.22.0 . The flaw allows malicious actors to inject and execute arbitrary JavaScript code across multiple functional areas, including content editing , link management , and ...

PT-2025-4485 · Optimizely · Episerver.Cms.Core

Name of the Vulnerable Software and Affected Versions: Optimizely EPiServer.CMS.Core versions prior to 12.32.0 Description: A medium-severity issue exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types,...

CVE-2025-22388: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting XSS vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or...

PT-2025-4484

Name of the Vulnerable Software and Affected Versions Optimizely EPiServer.CMS.Core versions prior to 12.22.0 Description A high-severity Stored Cross-Site Scripting XSS issue exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising us...

The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184

The wp-enable-svg WordPress plugin (versions through 0.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize uploaded SVG files. An attacker with author-level access or higher can upload a specially crafted SVG file containing malicious scripts. When other u...

Huang Yaoshi Pharmaceutical Management Software 安全漏洞

NWT Huang Yaoshi Pharmaceutical Management Software is a pharmaceutical management software from NWT. A security vulnerability exists in Huang Yaoshi Pharmaceutical Management version 16.0 and prior versions that originates from a file upload via the /XSDService.asmx interface that allows arbitra...

PT-2025-1629 · WordPress · Wp-Enable-Svg

Name of the Vulnerable Software and Affected Versions: wp-enable-svg WordPress plugin versions 0.7 and earlier wp-enable-svg WordPress plugin versions 0.2 and earlier Description: The issue is related to the wp-enable-svg WordPress plugin, which does not sanitize SVG files when uploaded. This...