WordPress plugin Security & Malware scan by CleanTalk 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A code issue vulnerability exists in WordPress plugin...

CVE-2024-56940

An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service DoS via excessive file uploads...

PT-2025-6495 · WordPress · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to and including 2.6.8 Description: The issue is related to Stored Cross-Site Scripting via REST API SVG File uploads due to insufficient input sanitization and output escaping. This allow...

WordPress plugin Brizy 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-6458

Name of the Vulnerable Software and Affected Versions Security & Malware scan by CleanTalk plugin for WordPress versions up to, and including, 2.149 Description The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and...

PT-2025-7139 · Q Free · Q-Free Maxtime

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions less than or equal to 2.11.0 Description: The issue allows an authenticated remote attacker to upload malicious files via crafted HTTP requests due to an unrestricted upload of files with dangerous types in the templat...

CVE-2024-13544

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-10649

wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket. This can lead to multiple security issues including denial of service, stored XSS, and information disclosure. The...

CVE-2024-13011

CVE-2024-13011 applies to the WordPress plugin WP Foodbakery and is described as an unauthenticated, arbitrary file upload vulnerability stemming from insufficient validation in the upload_publisher_profile_image function for versions up to 4.7. The Wordfence entry explicitly notes the impact cou...

WordPress plugin WP Foodbakery 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

OpenUI 访问控制错误漏洞

OpenUI is a UI program open-sourced by Weights & Biases. OpenUI suffers from an access control error vulnerability that stems from an unauthenticated endpoint allowing AWS S3 storage bucket file uploads and downloads, which can lead to denial of service, storage-based cross-site scripting, and...

The vulnerability of the OTRS request processing system, related to incorrect handling of HTTP request headers, allows a hacker to upload arbitrary files.

The vulnerability of the OTRS request processing system is related to the improper handling of HTTP request headers due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to upload arbitrary files...

The vulnerability of the online business analytics service IBM Cognos Analytics, related to unlimited uploading of dangerous types of files, allows a perpetrator to upload any type of files.

The vulnerability of the online business analytics service IBM Cognos Analytics relates to the unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to upload any type of files remotely...

PT-2025-6083 · WordPress · Wp Foodbakery

Name of the Vulnerable Software and Affected Versions: WP Foodbakery plugin for WordPress versions up to and including 4.7 Description: The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the upload publisher profile image...

Lumsoft ERP 安全漏洞

Lumsoft ERP is an enterprise resource management system from Lumsoft Corporation. A security vulnerability exists in Lumsoft ERP version 8, which originates from the file parameter file of the DoUpload/DoWebUpload function in file/Api/FileUploadApi.ashx that can lead to unrestricted uploads...

CVE-2025-24372

CKAN is an open-source DMS data management system for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could...

CVE-2021-4354

The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwpsplashscreenuploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites...

CVE-2021-4382

The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetchexternalimage function in versions up to, and including, 3.0.4. This makes it possible for authenticated attackers to upload arbitrary files on the affected site's server whic...

CVE-2021-4449

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may...

CVE-2025-0394

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ghbigfileupload function in all versions up to, and including, 3.7.3.5. This makes it possible for...