CVE-2025-63918

PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitrary locations...

CVE-2025-63918

CVE-2025-63918 affects the PDFPatcher executable. The root cause is insufficient validation of user-supplied file paths, enabling directory traversal attacks that allow attackers to upload arbitrary files to arbitrary locations. The entry notes a local attack vector with low complexity and high i...

VulnCheck KEV: CVE-2025-12974

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through...

PHP Business Website 代码问题漏洞

PHP Business Website is a PHP business website by the individual developer Iqbolshoh Ilhomjonov. PHP Business Website suffers from a code issue vulnerability that stems from incorrect manipulation of the file /admin/about.php, which could lead to unlimited uploads...

Bdtask Flight Booking Software 代码问题漏洞

Bdtask Flight Booking Software is an airline booking software from Bdtask Bangladesh. A code issue vulnerability exists in Bdtask Flight Booking Software that stems from incorrect manipulation of the component Edit Profile Page in the file /agent/profile/edit, which could lead to unlimited upload...

PT-2025-47084

Name of the Vulnerable Software and Affected Versions Jiusi OA versions prior to 20251103 Description A security issue has been identified in Jiusi OA. The issue involves unrestricted upload capabilities through manipulation of the FileData argument within an unknown function of the...

Jiusi OA 代码问题漏洞

Jiusi OA is a collaborative office system from China Jiusi Jiusi. A code issue vulnerability exists in Jiusi OA 20251102 and prior versions, which stems from an incorrect manipulation of the parameter FileData in File/OfficeServer, which can lead to unlimited uploads...

DouPHP 代码问题漏洞

DouPHP is an enterprise website builder from China DouPHP Company. A code issue vulnerability exists in DouPHP 1.8 Release 20251022 and earlier versions, which stems from the incorrect operation of the parameter File in the file upload/include/file.class.php, which can lead to unlimited uploads...

PT-2025-47054

Name of the Vulnerable Software and Affected Versions DouPHP versions prior to 1.8 Release 20251022 Description A flaw exists in DouPHP that allows for unrestricted file uploads. This issue is related to the file upload component and specifically affects the file.class.php file. The File argument...

EUVD-2025-26365

A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file apps/sim/app/api/files/upload/route.ts of the component HTML File Parser. Executing manipulation of the argument File can lead to unrestricte...

SUSE-SU-2025:4103-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.48 - CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT is enabled bsc1252753 - CVE-2025-55754: Fixed improper neutralization of escape, meta, or control sequences vulnerability bsc1252905 -...

WordPress Plugin Astra Security Suite - Firewall & Malware Scan Authorization Issues Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An authorization issue vulnerability exists in the WordPress plugin Astra Security Suite -...

Bdtask News365 代码问题漏洞

Bdtask News365 is a web magazine software from Bdtask Bangladesh. A code issue vulnerability exists in Bdtask News365 7.0.3 and earlier versions, which stems from incorrect manipulation of the parameters profileimage/bannerimage in the file /admin/dashboard/profile, which may result in unlimited...

Cross-site Scripting (XSS)

Overview @directus/app is an App dashboard for Directus Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Block Editor interface when users with upload files and edit item permissions inject malicious JavaScript. An attacker can execute arbitrary scripts in the...

CVE-2025-64711 PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on...

Siemens RUGGEDCOM ROX II Unrestricted Upload of File with Dangerous Type (CVE-2025-33023)

The affected devices do not properly enforce the restriction of files that can be uploaded from the web interface. This could allow an authenticated remote attacker with high privileges in the web interface to upload arbitrary files. This plugin only works with Tenable.ot. Please visit...

Malicious code in jasmine-procyon-capella-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d840f6107f0d615fde8a666d226e15946ccc996ec6ce8c0f8edda4a7b3ebe8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11521

The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0.2. This makes it possible for unauthenticated attacke...

CVE-2025-11170

The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CpiwmImportController::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2025-11988

The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action wpajaxnoprivcryptoconnectajaxprocess that allows calling the cryptodeletejson method with only a...