ELog security vulnerabilities

ELog is an electronic logging software with a web interface by the individual developer Stefan Ritt. A security vulnerability exists in ELog versions 3.1.5 through 20251014, which stems from allowing authenticated users to upload arbitrary HTML files, potentially leading to cross-site scripting...

PT-2025-44469

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.7.2 Description Nagios XI versions prior to 5.7.2 permit the upload and execution of PHP files within the Audio Import directory. The upload process does not adequately restrict file types or ensure storage outsid...

EUVD-2025-36564

DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite...

GHSA-2374-6CVW-QMX6 DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a rea...

DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a rea...

EUVD-2025-36566

DNN CKEditor Provider allows unauthenticated upload out-of-the-box...

CVE-2025-10932

CVE-2025-10932 is an Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module). The issue affects MOVEit Transfer versions 2025.0.0–before 2025.0.3, 2024.1.0–before 2024.1.7, and 2023.1.0–before 2023.1.16. The root cause is an input/AS2 request handling flaw that ca...

CVE-2025-10932 AS2 module allows uncontrolled file uploads

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...

CVE-2025-10932 AS2 module allows uncontrolled file uploads

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...

CVE-2025-12346

A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/autopost/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDi...

SUSE CVE-2025-61795

Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to...

Aviatrix Controller Unrestricted Upload of File (CVE-2021-40870)

While the Aviatrix UI requires authentication, many API calls do not enforce a check for authentication. Some of these API calls allow an unauthenticated attacker to upload arbitrary files, including .php scripts, to the filesystem. These uploaded scripts will be processed by the web frontend,...

Cross-site Scripting (XSS)

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of inline SVG files. An attacker can execute arbitrary scripts in the context of the...

Insecure Default Initialization of Resource

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the CKEditor Provider. An attacker can upload unauthorized files by accessing the...

CVE-2025-64095

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files...

CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files...

CVE-2025-64095

Summary (CVE-2025-64095) : DNN (DotNetNuke) versions before 10.1.1 are vulnerable to an unrestricted file upload due to the default HTML editor provider, allowing unauthenticated users to upload and overwrite files. This can enable website defacement and, when combined with other issues, potentia...

CVE-2025-64094

DNN (DotNetNuke) is affected by CVE-2025-64094 due to incomplete SVG sanitization, allowing stored XSS via uploaded SVGs. Affected versions are prior to 10.1.1; the issue stems from an incomplete fix for CVE-2025-48378 and is fixed in 10.1.1. The vulnerability enables execution of arbitrary JavaS...

CVE-2025-64094 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This...

CVE-2025-64094 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This...