9501 matches found
WordPress plugin Bit File Manager code-related vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Bit File Manager plugin, which stems from insufficient input cleanup and escaping during SVG file uploads, and no...
PT-2025-23590 · Unknown · Bit File Manager
Name of the Vulnerable Software and Affected Versions: The Bit File Manager versions up to, and including, 6.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers with...
Umbraco code vulnerabilities
Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A code issue vulnerability exists in Umbraco versions prior to 14.0.0 through 15.4.2 and prior to 16.0.0, which stems from the ability to upload files that do not match the configured allowable file...
juzaweb CMS allows cross-site scripting by uploading an SVG file
A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/file-manager/upload of the component Profile Page. The manipulation of the argument Upload leads to cross site scripting. The attack can...
CVE-2025-4963
The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...
CVE-2025-4800
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stmlmsaddassignmentattachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...
FreeScout code issues and vulnerabilities
FreeScout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout, Inc. A code issue vulnerability exists in FreeScout versions prior to 1.8.179, which stems from insufficient file upload checks and could lead to remote code...
Security Bulletin: IBM Watson Discovery Cartridge is affected by vulnerability in tomcat-embed-core-10.1.33.jar
Summary IBM Watson Discovery Cartridge contains a vulnerable version of tomcat-embed-core-10.1.33.jar Vulnerability Details CVEID:CVE-2025-24813 DESCRIPTION: Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to...
CVE-2025-4963
The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...
CVE-2025-4800
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stmlmsaddassignmentattachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...
PT-2025-23049 · WordPress · Masterstudy Lms Pro
Name of the Vulnerable Software and Affected Versions: MasterStudy LMS Pro plugin for WordPress versions up to, and including, 4.7.0 Description: The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm lms add assignmen...
PT-2025-23073 · WordPress · Wp Extended
Name of the Vulnerable Software and Affected Versions: WP Extended plugin for WordPress versions up to and including 3.0.15 Description: The issue is related to Stored Cross-Site Scripting via SVG file uploads, caused by insufficient input sanitization and output escaping. This allows authenticat...
WordPress plugin MasterStudy LMS Pro code issue vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...
SourceCodester Client Database Management System Code-related Vulnerabilities
SourceCodester Client Database Management System is a SourceCodester open source client database management system. A code issue vulnerability exists in SourceCodester Client Database Management System version 1.0, which stems from improper handling of the uploadedfilecancelled parameter in the...
Exploit for CVE-2025-4389
PoC exploit for CVE-2025-4389 is not present in the provided con...
MagicINFO 9 Path Traversal
The vulnerability of the MagicINFO 9 multi-media content centralized management system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain access and add arbitrary files...
llisoft MTA Maita Training System code-related vulnerabilities
The llisoft MTA Maita Training System is a training system from China Dongke llisoft. A code issue exists in version 4.5 of the llisoft MTA Maita Training System, which is caused by a parameter url operation that results in unlimited uploads...
CVE-2024-9544
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to...
CVE-2025-5058
The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setimage function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the...
