PT-2025-37106

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.11 through 18.3.2 Description An issue has been discovered in GitLab CE/EE that allows authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences. The vulnerabili...

WordPress plugin: Importing any XML, CSV, or Excel file into WordPress – Code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

Linux Distros Unpatched Vulnerability : CVE-2018-6334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used th...

Gitlab -- Vulnerabilities

Gitlab reports: Denial of Service issue in SAML Responses impacts GitLab CE/EE Server-Side Request Forgery issue in Webhook custom header impacts GitLab CE/EE Denial of Service issue in User-Controllable Fields impacts GitLab CE/EE Denial of Service issue in endpoint file upload impacts GitLab...

Linux Distros Unpatched Vulnerability : CVE-2017-9840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context ...

Linux Distros Unpatched Vulnerability : CVE-2025-1385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a...

Linux Distros Unpatched Vulnerability : CVE-2020-14209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar...

Linux Distros Unpatched Vulnerability : CVE-2022-0415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6. CVE-2022-0415 Note that Nessus relies on the presence of t...

Linux Distros Unpatched Vulnerability : CVE-2018-10092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and...

CVE-2025-44593

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13...

Maho is Vulnerable to Authenticated Remote Code Execution via File Upload

Summary In Maho 25.7.0, an authenticated staff user with access to the Dashboard and Catalog\Manage Products permissions can create a custom option on a listing with a file input field. By allowing file uploads with a .php extension, the user can use the filed to upload malicious PHP files, gaini...

CVE-2025-58180

CVE-2025-58180 affects OctoPrint ≤ 1.11.2. An authenticated attacker able to upload files can craft a filename that, when interpolated into a system event handler command, leads to arbitrary command execution on the host via a FileAdded event. The vulnerability relies on insufficient sanitization...

OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

Impact OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler an...

CVE-2025-7350 Rockwell Automation Stratix® IOS Cross-Site Request Forgery to Code Execution Vulnerability

A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication...

CVE-2025-7350 Rockwell Automation Stratix® IOS Cross-Site Request Forgery to Code Execution Vulnerability

A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication...

Halo security vulnerabilities

Halo is a powerful and easy-to-use open source website builder from Halo Open Source. A security vulnerability exists in Halo v2.20.17 and earlier versions, which stems from a server-side request forgery that could lead to the upload of malicious files...

CVE-2025-44593

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13...

Halo security vulnerabilities

Halo is a powerful and easy-to-use open source website builder from Halo Open Source. A security vulnerability exists in Halo versions prior to 2.20.13, which stems from bypassing file type detection and could lead to the upload of malicious files...

SAP NetWeaver AS Java Code Injection Vulnerability

SAP NetWeaver AS Java is a platform system from SAP, a German company. A code injection vulnerability exists in SAP NetWeaver AS Java that originates from allowing the uploading of arbitrary files, which could lead to full control of the system...

CVE-2025-44593

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13...