PT-2025-38614

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.8.x through 10.8.3 Mattermost versions 10.5.x through 10.5.8 Mattermost versions 9.11.x through 9.11.17 Mattermost versions 10.10.x through 10.10.1 Mattermost versions 10.9.x through 10.9.3 Mattermost versions prior to...

PT-2025-38501

Name of the Vulnerable Software and Affected Versions Goza - Nonprofit Charity WordPress Theme versions prior to and including 3.2.2 Description The Goza - Nonprofit Charity WordPress Theme is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the beplus import...

CVE-2025-10669

CVE-2025-10669 affects Airsonic-Advanced up to version 10.6.0 and is linked to the Playlist Upload Handler. The issue allows manipulation leading to unrestricted uploads, with remote initiation possible and public exploits available. Several sources (including PT-2025-38382) indicate a fix is to ...

PT-2025-38382

Name of the Vulnerable Software and Affected Versions Airsonic-Advanced versions prior to 10.6.1 Description A vulnerability exists in Airsonic-Advanced up to version 10.6.0 within the Playlist Upload Handler component. Manipulation of the component allows for unrestricted file uploads, and the...

ClipBucket: Permissions management and access control vulnerabilities

ClipBucket is an open source and freely downloadable PHP script from MacWarrior Open Source. It is used for sharing video sites. A security vulnerability exists in ClipBucket 5.5.0 and earlier versions, which stems from a lack of access control in the upload handler, and could allow an...

CVE-2025-10600

CVE-2025-10600 affects SourceCodester Online Exam Form Submission 1.0, specifically the /register.php endpoint where manipulation of the img parameter enables unrestricted file uploads. The connected documents confirm remote exploitation with an exploit published, indicating an attacker could upl...

CVE-2025-57176

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption metadata only with file contents...

SourceCodester Online Exam Form Submission: Code-related vulnerabilities

SourceCodester Online Exam Form Submission is a SourceCodester open source online exam submission system. A code issue vulnerability exists in SourceCodester Online Exam Form Submission version 1.0, which stems from incorrect manipulation of the parameter img in the file /register.php, which coul...

Frappe Learning Cross-Site Scripting Vulnerabilities

Frappe Learning is an easy-to-use open source learning management system from Frappe Open Source. A cross-site scripting vulnerability exists in Frappe Learning version 2.34.1 and prior versions, which stems from not adequately cleaning up uploaded content in personal profiles, and could lead to ...

CVE-2009-20006

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility admin/filemanager.php. The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to...

Malicious code in browser-webdriver-downloader (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01fb714365440560815380bba71421a48f96fcc47b83487acaaa72a1410c0ab5 Any computer that has this package installed or running should be considered fully compromised. All...

Denial Of Service (DoS)

com.liferay.portal, release.portal.bom are vulnerable to Denial Of Service DoS. The vulnerability is due to allowing unlimited file uploads through object entries attachment fields, which are stored in the documentlibrary, allowing an attacker to cause a potential Denial-of-Service DDoS attack...

PT-2025-38078

Name of the Vulnerable Software and Affected Versions by-night sms version 1.0 Description The /api/sms/upload/headImg endpoint allows the upload of arbitrary files. Users can upload files of any size and type. Recommendations As a temporary workaround, consider restricting access to the...

SourceCodester Pet Grooming Management Software Code Issues and Vulnerabilities

SourceCodester Pet Grooming Management Software is an open source pet grooming management system from SourceCodester. A code issue vulnerability exists in version 1.0 of SourceCodester Pet Grooming Management Software, which stems from an incorrect manipulation of the parameter websiteimage in th...

Ceragon EtherHaul series code issue vulnerabilities

The Ceragon EtherHaul series is a point-to-point infinite link device from Ceragon USA. A security vulnerability exists in the Ceragon EtherHaul series versions 7.4.0 through 10.7.3, which stems from the rfpiped service not performing authentication or path validation, which could result in...

SourceCodester Online Student File Management: Code-related vulnerabilities

SourceCodester Online Student File Management is a SourceCodester open source online student file management system. A code issue vulnerability exists in SourceCodester Online Student File Management version 1.0, which stems from an unrestricted upload function in file/savefile.php, which could...

CVE-2025-57176

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption metadata only with file contents...

CVE-2025-8492

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticat...

PT-2025-37370

Name of the Vulnerable Software and Affected Versions Ceragon Networks / Siklu Communication EtherHaul series versions 7.4.0 through 10.7.3 Description The rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak...

eCharge Hardy Barth Salia PLCC code issue vulnerability

The eCharge Hardy Barth Salia PLCC is a charging post controller from eCharge Germany. A code issue vulnerability exists in eCharge Hardy Barth Salia PLCC version 2.2.0, which stems from incorrect manipulation of the parameter setrfidlist in file/api.php, which could lead to arbitrary file upload...