Total
3141 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-48782 | 2025-06-06 | N/A | N/A | ||
| An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a malicious file. | |||||
| CVE-2025-49329 | 2025-06-06 | N/A | 6.6 MEDIUM | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress allows Upload a Web Shell to a Web Server. This issue affects Store Locator WordPress: from n/a through 1.5.2. | |||||
| CVE-2024-42563 | 1 Jerryhanjj | 1 Erp | 2025-06-05 | N/A | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file. | |||||
| CVE-2025-3054 | 2025-06-05 | N/A | 8.8 HIGH | ||
| The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this requires the 'Private Message' module to be enabled and the Business version of the PRO software to be in use. | |||||
| CVE-2024-24399 | 1 Lepton-cms | 1 Leptoncms | 2025-06-05 | N/A | 7.2 HIGH |
| An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area. | |||||
| CVE-2024-10627 | 1 Vanquish | 1 Woocommerce Support Ticket System | 2025-06-05 | N/A | 9.8 CRITICAL |
| The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. | |||||
| CVE-2024-22895 | 1 Dedecms | 1 Dedecms | 2025-06-05 | N/A | 8.8 HIGH |
| DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php. | |||||
| CVE-2024-11391 | 1 Advancedfilemanager | 1 Advanced File Manager | 2025-06-05 | N/A | 7.5 HIGH |
| The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. | |||||
| CVE-2024-47151 | 1 Honor | 1 Magicos | 2025-06-05 | N/A | 6.3 MEDIUM |
| Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution | |||||
| CVE-2024-13333 | 1 Advancedfilemanager | 1 Advanced File Manager | 2025-06-05 | N/A | 7.5 HIGH |
| The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled. | |||||
| CVE-2025-47577 | 2025-06-05 | N/A | 10.0 CRITICAL | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in TemplateInvaders TI WooCommerce Wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a before 2.10.0. | |||||
| CVE-2024-40744 | 1 Convert Forms Project | 1 Convert Forms | 2025-06-04 | N/A | 9.8 CRITICAL |
| Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8. | |||||
| CVE-2025-46078 | 1 Huocms | 1 Huocms | 2025-06-04 | N/A | 5.3 MEDIUM |
| HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server | |||||
| CVE-2025-46080 | 1 Huocms | 1 Huocms | 2025-06-04 | N/A | 5.3 MEDIUM |
| HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server. | |||||
| CVE-2024-11000 | 1 Codeastro | 1 Real Estate Management System | 2025-06-04 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutedit.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-10999 | 1 Codeastro | 1 Real Estate Management System | 2025-06-04 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-40400 | 1 Automad | 1 Automad | 2025-06-04 | N/A | 8.8 HIGH |
| An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. | |||||
| CVE-2024-23180 | 1 Appleple | 1 A-blog Cms | 2025-06-04 | N/A | 8.8 HIGH |
| Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary code by uploading a specially crafted SVG file. | |||||
| CVE-2025-1725 | 2025-06-04 | N/A | 6.4 MEDIUM | ||
| The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | |||||
| CVE-2025-48953 | 2025-06-04 | N/A | 5.5 MEDIUM | ||
| Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available. | |||||