ssm-erp 安全漏洞

ssm-erp is a production management ERP system by fenghaha individual developer. A security vulnerability exists in ssm-erp 0.0.1 and earlier versions, which stems from the mishandling of the parameter uploadFile by the function uploadFile, which could lead to arbitrary file uploads...

CVE-2025-4279

The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'externalimagereplacegetposts::replacepost' function in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with...

CVE-2025-28168

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension...

newbee-mall 代码问题漏洞

newbee-mall is a newbee open source e-commerce system. A code issue vulnerability exists in version 1.0 of newbee-mall, which stems from improper handling of the parameter File in the file ltd/newbee/mall/controller/common/UploadController.java, which could lead to arbitrary file uploads...

OutSystems Multiple File Upload 安全漏洞

OutSystems Multiple File Upload is a native multiple file upload component for the OutSystems platform from OutSystems, Inc. A security vulnerability exists in OutSystems Multiple File Upload versions prior to 3.1.0 that stems from insufficient client-side authentication could result in the uploa...

youkefu 代码问题漏洞

youkefu is a customer service support application by the individual developer zhangyanbo2007. A code issue vulnerability exists in youkefu 4.2.0 and earlier versions, which originates from the file youkefu-mastersrcmainjavacomukefuwebimwebhandler. Mishandling of the parameter imgFile in...

WordPress plugin External image replace 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in versions of Open WebUI prior to 0.6.6, which stems from a low-privileged user being able to upload HTML files containing JavaScript code, which...

CVE-2024-13418

Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that c...

CVE-2024-13418

CVE-2024-13418 is tied to WordPress ecosystems where multiple plugins/themes (notably the Smart Framework family: Benaa, April, Beyot, Auteur; and related plugins) expose an Arbitrary File Upload vulnerability via a missing capability check in ajaxUploadFonts(). The issue allows authenticated att...

CVE-2025-1305

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsbloggerinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...

CVE-2025-1304

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsbloggerinstallandactivateplugin function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and...

WordPress plugin NewsBlogger 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerabilit...

Elastic Kibana 安全漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic, Inc. A security vulnerability exists in Elastic Kibana versions prior to 8.12.0, which stems from an unrestricted upload of a dangerous type of file and could lead to the execution of arbitrary JavaScript in a...

PT-2025-18353 · WordPress · Newsblogger

Name of the Vulnerable Software and Affected Versions: NewsBlogger theme for WordPress versions up to, and including, 0.2.5.1 Description: The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger install and activate plugin...

CVE-2022-42449

Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications...

CVE-2022-27562

Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications...

WordPress Plugin Aeropage Sync for Airtable File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A file upload vulnerability...

CVE-2025-3914

The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropagemediadownloader' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access a...

BeyongCms 代码问题漏洞

BeyongCms is a lightweight content management system by youyiio individual developer. A code issue vulnerability exists in BeyongCms version 1.6.0, which stems from the incorrect operation of the parameter File in the file /admin/theme/Upload.html leading to unlimited uploads...