CVE-2025-55944

Slink v1.4.9 allows stored cross-site scripting XSS via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. The issue affects both authenticated and unauthenticated users...

PT-2025-35797

Name of the Vulnerable Software and Affected Versions Memos version 0.22 Description Memos version 0.22 is susceptible to Stored Cross-Site Scripting XSS through the upload attachment and user avatar features. The software does not validate the content type of uploaded data before serving it,...

Real-Estate-website-in-PHP 代码问题漏洞

Real-Estate-website-in-PHP is a free and open source real estate website by scriptandtools individual developers. A code issue vulnerability exists in Real-Estate-website-in-PHP version 1.0, which stems from an incorrect manipulation of the parameter uimage in the file register.php resulting in...

CVE-2025-52544 Arbitrary read file from the filesystem

E3 Site Supervisor Control firmware version 2.31F01 has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system...

CVE-2009-20011

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

CVE-2025-58159

WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension...

CVE-2025-52353

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload,...

CVE-2024-9648

The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WPUlikeProFileUploader class in all versions up to, and including, 1.9.3. This makes it possible for unauthenticated attackers to upload limited arbitrary files like .php2...

CVE-2025-54300

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads...

CVE-2009-20011

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

CVE-2009-20011

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

CVE-2009-20011

ContentKeeper Web Appliance (now Impero Software) versions prior to 125.10 are vulnerable to remote command execution via insecure handling of uploads in the mimencode CGI utility. Unauthenticated attackers can upload and execute arbitrary scripts as the Apache user; the exploit may optionally es...

ContentKeeper Web Appliance 安全漏洞

ContentKeeper Web Appliance is a web content filtering and security gateway appliance from ContentKeeper Australia. A security vulnerability exists in the ContentKeeper Web Appliance versions prior to 125.10 that stems from the mimencode CGI tool mishandling file uploads, which could lead to remo...

Linux Distros Unpatched Vulnerability : CVE-2019-16217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress before 5.2.3 allows XSS in media uploads because wpajaxuploadattachment is mishandled. CVE-2019-16217 Note that Nessus relies on the presence of the...

PT-2025-35367

Name of the Vulnerable Software and Affected Versions: ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 Description: ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to...

Linux Distros Unpatched Vulnerability : CVE-2024-22049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename...

Linux Distros Unpatched Vulnerability : CVE-2021-28658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file...

CVE-2025-58159 WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE)

WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension...

CVE-2025-58159

CVE-2025-58159 affects WeGIA Web manager for charitable institutions. Before version 3.4.11, uploaded files could be written to disk with arbitrary filenames, including PHP, due to improper validation and insufficient extension handling; a spreadsheet file followed by PHP code could be uploaded a...

PT-2025-35328

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.11 Description: WeGIA is a Web manager for charitable institutions. A remote code execution issue was identified due to improper validation of uploaded files. The application allows attackers to upload files with...