CVE-2025-4212

The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

egovframe-common-components 安全漏洞

egovframe-common-components is a collection of commonly used functions open-sourced by the e-Government Standard Framework Center. A security vulnerability exists in egovframe-common-components version 4.3.1 and earlier, which originates from an unauthenticated file upload endpoint and could lead...

CampCodes Retro Basketball Shoes Online Store 代码问题漏洞

CampCodes Retro Basketball Shoes Online Store is an online store for retro basketball shoes from CampCodes, Inc. A code issue vulnerability exists in CampCodes Retro Basketball Shoes Online Store version 1.0, which stems from an incorrect manipulation of the parameter productimage in the file...

CVE-2025-51661

A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storage. SystemFileStorage.savefile method in core/storage.py uses filenames from user input without validation to construct savepath and save...

AudioCodes Fax Server 安全漏洞

AudioCodes Fax Server is a fax server from AudioCodes Israel. A security vulnerability exists in AudioCodes Fax Server version 2.6.23 and earlier, which originates from an unverified backup upload endpoint and could lead to arbitrary file uploads and execution...

EUVD-2025-197970

The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2025-197959

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2025-41347

CVE-2025-41347 affects WinPlus v24.11.27 from Informática del Este. A flaw permits uploading dangerous file types via POST to /WinplusPortal/ws/sWinplus.svc/json/uploadfile, enabling a possible webshell upload. Public records identify the root cause as an unrestricted upload vector. Remediation i...

CVE-2025-41347 Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'...

CVE-2025-41347 Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'...

CVE-2025-4212

The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-12457

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

EUVD-2025-197938

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the ajaxuploadhandle function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type validation...

CVE-2025-12457

CVE-2025-12457 concerns the WordPress plugin Enable SVG, WebP, and ICO Upload. The Wordfence vulnerability entry confirms a Stored Cross-Site Scripting (XSS) flaw via SVG file uploads in all versions up to 1.1.2, exploitable by an authenticated attacker with Author-level access or higher to injec...

CVE-2025-12457 Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2025-4212 Checkout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scripting

The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-12775

CVE-2025-12775 concerns the WP Dropzone WordPress plugin (versions up to 1.1.0). Authenticated attackers with subscriber-level access can upload arbitrary files via the chunked upload path handled by ajax_upload_handle, because files are written directly to the uploads directory before any file t...

EUVD-2025-197911

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through...

WordPress Enable SVG, WebP, and ICO Upload plugin <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Uploads vulnerability discovered by Sornram9254 in WordPress Plugin Enable SVG, WebP & ICO Upload versions = 1.1.2...

CVE-2025-12974

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through...