CVE-2025-9978

The Jeg Kit for Elementor WordPress plugin (versions prior to 2.7.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to properly sanitize the contents of SVG files during the upload process via the xmlrpc.php file. An attacker could exploit this by injectin...

CVE-2025-9978 Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS

The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability...

PT-2025-43664

Name of the Vulnerable Software and Affected Versions PerfreeBlog version 4.0.11 Description PerfreeBlog version 4.0.11 contains a File Upload issue within the installPlugin function. This allows for potential unauthorized file uploads. Recommendations Update to a newer version that contains a fi...

VulnCheck KEV: CVE-2025-6440

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdpsavecanvasdesignajax' function in all versions up to, and including, 1.9.26. This mak...

CVE-2025-41723 Sauter: Directory Traversal in importFile SOAP Method

The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations...

Hikvision CSMP iSecure Center 安全漏洞

Hikvision CSMP iSecure Center is a comprehensive security management platform from Hikvision China. A security vulnerability exists in Hikvision CSMP iSecure Center version 2023-06-25 and earlier, which originates from /center/api/files directory traversal and could lead to file uploads...

PT-2025-43162

Name of the Vulnerable Software and Affected Versions CMSSuperHeroes Clanora versions prior to 1.3.1 Description The software contains a flaw related to unrestricted file uploads, potentially allowing the use of malicious files. This could allow an attacker to upload files of dangerous types...

Wordpress Plugin Wastia Theme 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A security...

Wordpress Plugin Medcity 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

WordPress Plugin Zippy 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

GHSA-9P44-Q66P-XM6P ProcessWire CMS vulnerable to resource-exhaustion Denial of Service

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service...

Data Amplification

Overview processwire/processwire is a CMS/CMF. Affected versions of this package are vulnerable to Data Amplification via the Language Support admin interface. A user with lang-edit permission can cause resource exhaustion by uploading a malicious ZIP file that is automatically extracted without...

PT-2025-45329

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions through 51.1.36 Description The software contains a flaw that permits the upload of files with dangerous types, potentially allowing the upload of a web shell to a web server. Recommendations Update King Addo...

QDocs Smart School Management System 安全漏洞

QDocs Smart School Management System is a smart group building system from QDocs, Inc. A security vulnerability exists in QDocs Smart School Management System version 7.1, which stems from a logic flaw that allows bypassing file type restrictions and could result in uploading arbitrary PHP files...

EUVD-2025-35048

A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service DoS via uploading an excessive number of files...

CVE-2025-56223

A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service DoS via uploading an excessive number of files...

CVE-2025-56223

The SigningHub electronic signature platform, developed by Ascertia , is vulnerable to a Denial of Service (DoS) attack in versions 8.6.8 .

CVE-2025-56223

A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service DoS via uploading an excessive number of files...

CVE-2023-28814

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released for China's domestic market only, with no overse...

CVE-2025-11256

The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversatio...