Total
3062 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-10960 | 1 Brizy | 1 Brizy | 2025-02-20 | N/A | 9.9 CRITICAL |
| The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all versions up to, and including, 2.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | |||||
| CVE-2024-13544 | 1 Amini7 | 1 Zarinpal Paid Download | 2025-02-20 | N/A | 4.8 MEDIUM |
| The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) | |||||
| CVE-2021-44967 | 1 Limesurvey | 1 Limesurvey | 2025-02-20 | 9.0 HIGH | 8.8 HIGH |
| A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding. | |||||
| CVE-2024-57407 | 2025-02-19 | N/A | 7.3 HIGH | ||
| An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file. | |||||
| CVE-2023-25828 | 1 Pluck-cms | 1 Pluck | 2025-02-19 | N/A | 7.2 HIGH |
| Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process before being available on the site. Due to lack of file extension validation, it is possible to upload a crafted JPEG payload containing an embedded PHP web-shell. An attacker may navigate to it directly to achieve RCE on the underlying web server. Administrator credentials for the Pluck CMS web interface are required to access the albums module feature, and are thus required to exploit this vulnerability. CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.2 High) | |||||
| CVE-2023-27246 | 1 Mk-auth | 1 Mk-auth | 2025-02-18 | N/A | 8.8 HIGH |
| An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess file. | |||||
| CVE-2025-22654 | 2025-02-18 | N/A | 10.0 CRITICAL | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified allows Using Malicious Files. This issue affects Simplified: from n/a through 1.0.6. | |||||
| CVE-2025-1165 | 2025-02-18 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2021-3267 | 1 Kitesky | 1 Kitecms | 2025-02-18 | N/A | 7.2 HIGH |
| File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function. | |||||
| CVE-2023-26968 | 1 Atrocore | 1 Atrocore | 2025-02-18 | N/A | 9.8 CRITICAL |
| In Atrocore 1.5.25, the Create Import Feed option with glyphicon-glyphicon-paperclip function is vulnerable to Unauthenticated File upload. | |||||
| CVE-2023-26830 | 1 Gladinet | 1 Centrestack | 2025-02-18 | N/A | 7.2 HIGH |
| An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by uploading malicious files to the server. | |||||
| CVE-2021-31707 | 1 Kitesky | 1 Kitecms | 2025-02-18 | N/A | 9.8 CRITICAL |
| Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type. | |||||
| CVE-2024-2930 | 1 Oretnom23 | 1 Music Gallery Site | 2025-02-18 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=save_music. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258001 was assigned to this vulnerability. | |||||
| CVE-2024-2849 | 1 Ganeshrkt | 1 Simple File Manager Web App | 2025-02-18 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257770 is the identifier assigned to this vulnerability. | |||||
| CVE-2024-2754 | 1 Donbermoy | 1 Complete E-commerce Site | 2025-02-18 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257544. | |||||
| CVE-2024-2690 | 1 Razormist | 1 Online Discussion Forum Site | 2025-02-18 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file /uupdate.php. The manipulation of the argument ima leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257388. | |||||
| CVE-2025-1388 | 2025-02-17 | N/A | 8.8 HIGH | ||
| Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells | |||||
| CVE-2024-25802 | 1 Skinsoft | 1 S-museum | 2025-02-14 | N/A | 9.8 CRITICAL |
| SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content. | |||||
| CVE-2024-27964 | 1 Gesundheit-bewegt | 1 Zippy | 2025-02-14 | N/A | 8.8 HIGH |
| Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.9. | |||||
| CVE-2023-0670 | 1 Ulearn Project | 1 Ulearn | 2025-02-13 | N/A | 7.2 HIGH |
| Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the application does not validate that the uploaded image is actually an image. | |||||