Total
2929 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-51208 | 1 Phpgurukul | 1 Boat Booking System | 2025-03-13 | 7.2 High |
| File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter. | ||||
| CVE-2023-42286 | 1 Eyoucms | 1 Eyoucms | 2025-03-13 | 9.8 Critical |
| There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carefully crafted malicious payload. | ||||
| CVE-2021-31207 | 1 Microsoft | 1 Exchange Server | 2025-03-13 | 6.6 Medium |
| Microsoft Exchange Server Security Feature Bypass Vulnerability | ||||
| CVE-2021-36741 | 2 Microsoft, Trendmicro | 5 Windows, Apex One, Officescan and 2 more | 2025-03-13 | 8.8 High |
| An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability. | ||||
| CVE-2024-52677 | 1 Hkcms | 1 Hkcms | 2025-03-13 | 9.8 Critical |
| HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php. | ||||
| CVE-2024-42778 | 1 Lopalopa | 1 Music Management System | 2025-03-13 | 8.8 High |
| An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file. | ||||
| CVE-2024-25801 | 1 Skinsoft | 1 S-museum | 2025-03-13 | 4.6 Medium |
| SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a file. | ||||
| CVE-2024-13359 | 1 Tychesoftwares | 1 Product Input Fields For Woocommerce | 2025-03-13 | 8.1 High |
| The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched. | ||||
| CVE-2024-13908 | 1 Bestwebsoft | 1 Smtp | 2025-03-13 | 7.2 High |
| The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-13882 | 1 Coderevolution | 1 Aiomatic | 2025-03-13 | 8.8 High |
| The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-3022 | 1 Reputeinfosystems | 1 Bookingpress | 2025-03-13 | 7.2 High |
| The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_process_upload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to upload arbitrary files on the affected site's server, enabling remote code execution. | ||||
| CVE-2022-39983 | 1 Instantdeveloper | 1 Rd3 | 2025-03-12 | 9.8 Critical |
| File upload vulnerability in Instantdeveloper RD3 22.0.8500, allows attackers to execute arbitrary code. | ||||
| CVE-2023-24317 | 1 Judging Management System Project | 1 Judging Management System | 2025-03-12 | 8.1 High |
| Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php. | ||||
| CVE-2021-33224 | 1 Umbraco | 1 Umbraco Forms | 2025-03-12 | 9.8 Critical |
| File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. | ||||
| CVE-2021-35290 | 1 Balero Cms Project | 1 Balero Cms | 2025-03-12 | 7.2 High |
| File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page. | ||||
| CVE-2025-28915 | 2025-03-12 | 9.1 Critical | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit allows Upload a Web Shell to a Web Server. This issue affects ThemeEgg ToolKit: from n/a through 1.2.9. | ||||
| CVE-2024-2268 | 1 Keerti1924 | 1 Online Bookstore Website | 2025-03-12 | 4.7 Medium |
| A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0. It has been classified as critical. Affected is an unknown function of the file /product_update.php?update=1. The manipulation of the argument update_image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256038 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2022-2883 | 1 Octopus | 1 Octopus Server | 2025-03-11 | 7.5 High |
| In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service | ||||
| CVE-2025-22213 | 2025-03-11 | N/A | ||
| Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions. | ||||
| CVE-2022-41217 | 1 Hybridsoftware | 1 Cloudflow | 2025-03-11 | 9.8 Critical |
| Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage. | ||||