Linux Distros Unpatched Vulnerability : CVE-2021-41868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality. CVE-2021-41868 No...

CVE-2024-47260

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memory. Axis has released patched AXIS OS versions for the...

CVE-2025-1307

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-1307

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-1306

The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...

CVE-2025-1307

CVE-2025-1307 affects the Newscrunch WordPress theme; versions up to 1.8.4.1 are vulnerable to an arbitrary file upload due to a missing capability check in newscrunch_install_and_activate_plugin(). Affected attackers: authenticated users with Subscriber+ privileges; impact includes potential rem...

Linux Distros Unpatched Vulnerability : CVE-2016-10712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of streamgetmetadata can be controlled if the input can be controlled...

shishuocms 代码问题漏洞

shishuocms Shishuocms CMS is a learning content management system by gaofeng4623 individual developer. A code issue vulnerability exists in shishuocms version 1.1, which stems from the existence of unlimited uploads in the ManageUpLoadAction.java file, which could lead to remote attacks...

The vulnerability in the application software interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload files and gain access to read, modify, or delete data.

The vulnerability of the application programming interface of the Cisco Identity Services Engine ISE management platform is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to upload files and gain read,...

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics allows a malicious actor to gain unauthorized access to the system by allowing unlimited upload of sensitive files.

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics is related to the unlimited uploading of dangerous files. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the system by uploading a...

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics allows a malicious actor to gain unauthorized access to the system by allowing unlimited upload of sensitive files.

The vulnerability of the cloud platform for business analytics and planning in IBM Planning Analytics is related to the unlimited uploading of dangerous files. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the system by uploading a...

CVE-2024-13638

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the...

CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

zz 安全漏洞

zz is an e-commerce platform for zj1983 individual developers. A security vulnerability exists in zz 2024-8 and earlier versions, which stems from improper handling of the file parameter in the /resolve file, resulting in unlimited uploads...

zz 代码问题漏洞

zz is an e-commerce platform for zj1983 individual developers. A code issue vulnerability exists in zz 2024-8 and prior versions, which stems from unrestricted file uploads and could lead to remote code execution...

LightPicture 代码问题漏洞

LightPicture is an enterprise/team/individual image resource management system, image bed system for osuuuu individual developers. A code issue vulnerability exists in LightPicture version 1.2.2, which stems from improper handling of the file parameter in the /app/controller/Api.php file, resulti...

CVE-2024-13611

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attacke...

CVE-2024-13568

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored...

CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...

CVE-2024-13638

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the...