CVE-2024-13451

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing...

CVE-2024-13451

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing...

CVE-2024-13451 Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing...

CVE-2024-13451

The CVE-2024-13451 entry concerns the WordPress plugin Contact Form by Bit Form (Bit Form: Multi Step Form, Calculation, Payment, Custom Form builder). Affected versions include all up to 2.17.4, where there is Sensitive Information Exposure via file uploads caused by insufficient directory listi...

CVE-2024-13451 Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing...

PT-2025-27601 · WordPress · The Contact Form By Bit Form

Name of the Vulnerable Software and Affected Versions: The Contact Form by Bit Form plugin for WordPress versions up to and including 2.17.4 Description: The issue allows unauthenticated attackers to extract sensitive data, including files uploaded via a form, due to insufficient directory listin...

SourceCodester Simple Company Website 代码问题漏洞

SourceCodester Simple Company Website is a simple company website from SourceCodester, Inc. A code issue vulnerability exists in version 1.0 of the SourceCodester Simple Company Website, which stems from a misbehavior of the parameter img in the file /classes/Users.php?f=save that results in...

SourceCodester Simple Company Website 代码问题漏洞

SourceCodester Simple Company Website is a simple company website from SourceCodester, Inc. A code issue vulnerability exists in SourceCodester Simple Company Website version 1.0, which stems from the incorrect operation of the parameter img in the file /classes/SystemSettings.php?f=updatesetting...

Code-Projects Simple Photo Gallery 安全漏洞

Code-Projects Simple Photo Gallery is a simple photo gallery system from Code-Projects open source. A security vulnerability exists in Code-Projects Simple Photo Gallery version 1.0, which stems from an unlimited upload due to incorrect manipulation of the parameter fileimg in file/upload-photo.p...

Facebook's New AI Tool Asks to Upload Your Photos for Story Ideas, Sparking Privacy Concerns

Facebook, the social network platform owned by Meta, is asking for users to upload pictures from their phones to suggest collages, recaps, and other ideas using artificial intelligence AI, including those that have not been directly uploaded to the service. According to TechCrunch, which first...

Relative Path Traversal

Overview mikopbx/core is a Free PBX system for SMB based on Asterisk Affected versions of this package are vulnerable to Relative Path Traversal via the PostController.php process. An attacker can execute arbitrary code and access sensitive files by uploading a crafted PHP script to an arbitrary...

CVE-2025-6705

A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new...

The vulnerability of the private application programming interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to execute arbitrary code.

The vulnerability of the private application programming interface of the Cisco Identity Services Engine ISE management platform is related to the absence of a mechanism for checking uploaded files. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the process that handles file uploads and database creation. An attacker can gain unauthorized access to sensitive files by leveraging default file permissions that allow any operating system account to...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the process that handles file uploads and database creation. An attacker can gain unauthorized access to sensitive files by leveraging default file permissions that allow any operating system account to...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the process that handles file uploads and database creation. An attacker can gain unauthorized access to sensitive files by leveraging default file permissions that allow any operating system account to...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the process that handles file uploads and database creation. An attacker can gain unauthorized access to sensitive files by leveraging default file permissions that allow any operating system account to...

UBUNTU-CVE-2025-1754

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource...

CVE-2025-1754

CVE-2025-1754 affects GitLab CE/EE, versions 17.2–17.11.4, 18.0–18.0.2, and 18.1–18.1.0, with an unauthenticated attacker able to upload arbitrary files to public projects via crafted API requests. The underlying issue is an access-control weakness that permits file uploads without authentication...

CVE-2025-1754 Missing Authentication for Critical Function in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource...