Total
2765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-13201 | 2025-01-09 | N/A | N/A | ||
| A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/main/java/com/my/blog/website/controller/admin/AttachtController.java of the component Admin Attachment Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2024-1567 | 1 Royal-elementor-addons | 1 Royal Elementor Addons | 2025-01-08 | N/A | 9.8 CRITICAL |
| The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous file types such as .svgz on the affected site's server which may make cross-site scripting or remote code execution possible. | |||||
| CVE-2023-33386 | 1 Marsctf Project | 1 Marsctf | 2025-01-08 | N/A | 9.8 CRITICAL |
| MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background. | |||||
| CVE-2020-19028 | 1 Emlog | 1 Emlog | 2025-01-08 | N/A | 7.5 HIGH |
| *File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function. | |||||
| CVE-2023-33569 | 1 Faculty Evaluation System Project | 1 Faculty Evaluation System | 2025-01-08 | N/A | 7.2 HIGH |
| Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update_user. | |||||
| CVE-2025-22137 | 2025-01-08 | N/A | N/A | ||
| Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anonymous shares are allowed) user to overwrite arbitrary files on the server, including sensitive system files, via HTTP POST requests. The issue has been patched in version 1.4.0. | |||||
| CVE-2024-12853 | 2025-01-08 | N/A | 8.8 HIGH | ||
| The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | |||||
| CVE-2024-12854 | 2025-01-08 | N/A | 8.8 HIGH | ||
| The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | |||||
| CVE-2023-33498 | 1 Alist Project | 1 Alist | 2025-01-07 | N/A | 8.8 HIGH |
| alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file. | |||||
| CVE-2023-33601 | 1 Phpok | 1 Phpok | 2025-01-07 | N/A | 8.8 HIGH |
| An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2024-43243 | 2025-01-07 | N/A | N/A | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGlow JobBoard Job listing allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through 1.2.6. | |||||
| CVE-2023-34747 | 1 Ujcms | 1 Ujcms | 2025-01-06 | N/A | 9.8 CRITICAL |
| File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. | |||||
| CVE-2024-13145 | 2025-01-06 | N/A | N/A | ||
| A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/site/blog/my/core/controller/admin/uploadController. java. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-13144 | 2025-01-06 | N/A | N/A | ||
| A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-13134 | 2025-01-05 | N/A | N/A | ||
| A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher of the file src/main/Java/com/wdd/studentmanager/controller/TeacherController. java. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-13133 | 2025-01-05 | N/A | N/A | ||
| A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the file src/main/Java/com/wdd/studentmanager/controller/StudentController. java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2023-31541 | 1 Ckeditor | 1 Ckeditor | 2025-01-03 | N/A | 9.8 CRITICAL |
| A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server. | |||||
| CVE-2024-27923 | 1 Getgrav | 1 Grav | 2025-01-02 | N/A | 8.8 HIGH |
| Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue. | |||||
| CVE-2024-56264 | 2025-01-02 | N/A | N/A | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector allows Upload a Web Shell to a Web Server.This issue affects ACF City Selector: from n/a through 1.14.0. | |||||
| CVE-2024-56249 | 2025-01-02 | N/A | N/A | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in Webdeclic WPMasterToolKit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through 1.13.1. | |||||