CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

CVE-2025-6207

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-5061

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...

Glossword 安全漏洞

Glossword is a free dictionary application by DmitrySh Individual Developer. A security vulnerability exists in Glossword versions 1.8.8 through 1.8.12, which stems from an unvalidated uploaded file type and could lead to arbitrary file uploads and remote code execution...

PT-2025-31913 · WordPress · Wp Import Export Lite

Name of the Vulnerable Software and Affected Versions: WP Import Export Lite versions through 3.9.28 Description: The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpie tempalte import function. This allows...

BentoML 1.4.x < 1.4.19 Server-Side Request Forgery

According to its banner, the version of BentoML running on the remote host is 1.4.x 1.4.8. It is, therefore, affected by a Server-Side Request Forgery SSRF vulnerability in File Upload Processing. Note that the scanner has not tested for these issues but has instead relied only on the application...

WordPress plugin WP Import Export Lite 代码问题漏洞

WordPress WP Import Export Lite plugin is a free plugin for WordPress, mainly used for batch import and export website data. WordPress WP Import Export Lite plugin suffers from a missing file type validation vulnerability that can be exploited by attackers to cause arbitrary file uploads and remo...

FreeFloat FTP Server 安全漏洞

FreeFloat FTP Server is an FTP service from FreeFloat, Inc. A security vulnerability exists in FreeFloat FTP Server that stems from a design flaw that could lead to arbitrary file uploads and remote code execution...

PT-2025-31982 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server affected versions not specified Description: FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server...

WordPress plugin Asset-Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Alone Theme 7.8.3 Arbitrary Plugin Upload / Code Execution

WordPress Alone Theme versions 7.8.3 and below are vulnerable to an unauthenticated arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload and install arbitrary plugin ZIP files from remote URLs via an unprotected AJAX endpoint — resulting in remote code executi...

ZKEACMS 安全漏洞

ZKEACMS is a visually designed, WYSIWYG content management system from ZKEASOFT open source. A security vulnerability exists in ZKEACMS v4.1, which stems from allowing arbitrary file uploads and could lead to the execution of arbitrary code...

XBoot 代码问题漏洞

XBoot is a one-stop front-end and back-end separation rapid development platform for Exrick individual developers. A code issue vulnerability exists in XBoot 3.3.4 and prior versions, which stems from an incorrect manipulation of the parameter File resulting in unlimited uploads...

Code-Projects Kitchen Treasure 代码问题漏洞

Code-Projects Kitchen Treasure is an open source kitchen software from Code-Projects. A code issue vulnerability exists in Code-Projects Kitchen Treasure version 1.0, which stems from the incorrect manipulation of the parameter photo in the file /userregistration.php resulting in unlimited upload...

CVE-2025-7847

The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restsimpleFileUpload function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the filter parameter in the Recent Uploads page. An attacker can cause the server to become unresponsive by submitting specially crafted regular expressions. Note: This is exploitable if the Recent Uploads...

CVE-2025-54796

Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled which is the default, an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9...

Copyparty 安全漏洞

Copyparty is a portable file server for ed individual developers. A security vulnerability exists in Copyparty versions prior to 1.18.9, which stems from the Recent Uploads page filter allowing arbitrary regular expressions, which may cause the server to deadlock...

CVE-2025-54796 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page

Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled which is the default, an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9...

CVE-2025-54796 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page

Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled which is the default, an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9...