PT-2026-1045

Name of the Vulnerable Software and Affected Versions jackying H-ui.admin versions up to 3.1 Description A flaw exists in jackying H-ui.admin that allows for unrestricted file uploads. This issue affects an unknown function within the /lib/webuploader/0.1.5/server/preview.php library. The attack...

PT-2026-1042

Name of the Vulnerable Software and Affected Versions EmpireSoft EmpireCMS versions prior to 8.0 Description A flaw exists in EmpireSoft EmpireCMS that allows for unrestricted file uploads. This issue is located in the CheckSaveTranFiletype function within the e/class/connect.php file. Successful...

CVE-2025-67706

ArcGIS Server version 11.5 and earlier on Windows and Linux does not properly validate uploaded files file, which allows remote attackers to upload arbitrary files...

Nextcloud: Valid share tokens allow to access tempory upload files of share owner

A vulnerability was discovered that allowed access to temporary upload files of a share owner using valid share tokens...

EUVD-2025-206100

ArcGIS Server version 11.5 and earlier on Windows and Linux does not properly validate uploaded files file, which allows remote attackers to upload arbitrary files...

EUVD-2025-206101

ArcGIS Server version 11.5 and earlier on Windows and Linux does not properly validate uploaded files file, which allows remote attackers to upload arbitrary files...

PT-2026-1031

Name of the Vulnerable Software and Affected Versions xnx3 wangmarket versions up to 6.4 Description A flaw exists in the XML File Handler component of xnx3 wangmarket. Specifically, the uploadImage function within the /sits/uploadImage.do file allows for unrestricted file uploads through...

wangmarket 代码问题漏洞

wangmarket is a privatized deployment of your own SAAS cloud builder system for xnx3 individual developers in China. A code issue vulnerability exists in wangmarket 6.4 and earlier versions, which stems from the incorrect operation of the parameter image in the file /sits/uploadImage.do, which...

CVE-2025-67707

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded...

CVE-2025-67706

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded...

CVE-2025-67707

ArcGIS Server versions 11.5 and earlier on Windows and Linux are affected by an input validation issue: uploaded files are not properly validated, allowing remote unauthenticated attackers to upload arbitrary files to designated upload directories. The server architecture restricts uploaded files...

CVE-2025-67706 Unvalidated File Upload vulnerability in ArcGIS Server.

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded...

CVE-2025-67706

ArcGIS Server (Windows/Linux) 11.5 and earlier exposes a vulnerability where uploaded files are not properly validated, allowing remote unauthenticated arbitrary file uploads to designated directories. The server architecture prevents execution of uploaded files and enforces non-executable storag...

CVE-2025-69210

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting XSS vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These...

PT-2025-54465

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 11.5 and earlier Description ArcGIS Server on Windows and Linux does not properly validate uploaded files, potentially allowing remote attackers to upload arbitrary files. Recommendations At the moment, there is no...

WordPress CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin <= 4.2 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by luckybuddy in WordPress Plugin cits-support-svg-webp-media-upload versions = 4.2...

FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

A stored cross-site scripting XSS vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowi...

EUVD-2025-205844

FacturaScripts is Vulnerable to Stored Cross-Site Scripting XSS via XML File Upload...

CVE-2025-69210 FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting XSS vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These...

BiggiDroid Simple PHP CMS 代码问题漏洞

BiggiDroid Simple PHP CMS is a content management system from BiggiDroid open source. A code issue vulnerability exists in BiggiDroid Simple PHP CMS version 1.0, which stems from the incorrect manipulation of the parameter image in the file /admin/edit.php, which can lead to unrestricted uploads...