CVE-2025-13516: Unrestricted Upload of File with Dangerous Type

The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's savefile function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessibl...

CVE-2025-11087: Cross-Site Request Forgery (CSRF)

The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This makes it possib...

CVE-2021-36532: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php...

WordPress plugin Ninja Forms - File Uploads Extension 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is an application plugin for WordPress. WordPress Ninja Forms - File Uploads Extension Plugin...

CVE-2022-0888: Unrestricted Upload of File with Dangerous Type

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious file...

CVE-2022-0889: Improper Neutralization of Input During Web Page Generation

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the /includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web script...

CVE-2022-25487

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

Remote code execution

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

CVE-2022-25487

Atom CMS v2.0 contains a remote code execution (RCE) vulnerability exploitable via /admin/uploads.php. The Nuclei template and CIRCL/CVE records confirm the issue stems from improper handling in the uploads path, enabling arbitrary code execution on the affected system. Impact is described as ful...

CVE-2022-25487: Unrestricted Upload of File with Dangerous Type

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

CVE-2020-25406

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

CVE-2020-25406

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

CVE-2020-25406: Unrestricted Upload of File with Dangerous Type

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

CVE-2014-4852

CVE-2014-4852 describes an SQL injection in The Digital Craft AtomCMS, in the file admin/uploads.php (likely around version 2.0). The vulnerability allows remote attackers to manipulate the database by supplying an arbitrary SQL command via the id parameter, as documented in multiple feeds (NVD, ...

CVE-2014-4852: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter...

Info Fisier 1.0 XSS / SQL Injection

Author : kaozc9 + Email : [email protected] + Site : www.paradisextem.co.cc + Team : ParadisexTeam + Dork : Powered by Info Fisier. =========================================XSS================================================== Affected Files: http://server/path/search.php...

Info Fisier 1.0 multiple Vulnerabilities

Exploit for unknown platform in category web applications ======================================== Info Fisier 1.0 multiple Vulnerabilities ======================================== + Dork : Powered by Info Fisier...

info fisier 1.0 - Multiple Vulnerabilities

info fisier 1.0 - Multiple Vulnerabilities + Author : kaozc9 + Email : [email protected] + Site : www.paradisextem.co.cc + Team : ParadisexTeam + Dork : Powered by Info Fisier. =========================================XSS================================================== Affected Files:...

CVE-2006-6878

admin/uploads.php in PHP-Update 2.7 and earlier allows remote attackers to gain privileges by setting the rights7 parameter to 1 during a login action...

CVE-2006-6879: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated users to upload arbitrary PHP scripts to the gfx/ and files/ directories via the userfile parameter...