Total
3226 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-19028 | 1 Emlog | 1 Emlog | 2025-01-08 | 7.5 High |
| *File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function. | ||||
| CVE-2025-22137 | 2025-01-08 | 9.8 Critical | ||
| Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anonymous shares are allowed) user to overwrite arbitrary files on the server, including sensitive system files, via HTTP POST requests. The issue has been patched in version 1.4.0. | ||||
| CVE-2024-29891 | 1 Zitadel | 1 Zitadel | 2025-01-08 | 8.7 High |
| ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in the browser, where a session in ZITADEL needs to be active for this exploit to work. The exploit could only be reproduced if the victim was using Firefox. Chrome, Safari as well as Edge did not execute the code. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17. | ||||
| CVE-2023-3032 | 1 Mobatime | 1 Mobatime Web Application | 2025-01-08 | 8.1 High |
| Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22. | ||||
| CVE-2023-28699 | 1 Wddgroup | 1 Fantasy | 2025-01-08 | 8.8 High |
| Wade Graphic Design FANTSY has a vulnerability of insufficient filtering for file type in its file update function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload a PHP file containing a webshell to perform arbitrary system operation or disrupt service. | ||||
| CVE-2023-28700 | 1 Itpison | 1 Omicard Edm | 2025-01-08 | 6.8 Medium |
| OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. | ||||
| CVE-2023-33569 | 1 Faculty Evaluation System Project | 1 Faculty Evaluation System | 2025-01-08 | 7.2 High |
| Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update_user. | ||||
| CVE-2022-41573 | 2025-01-08 | 9.8 Critical | ||
| An issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading of executable files. A user can upload a .png file containing PHP code and then rename it to have the .php extension. It will then be accessible at an images/common/ URI for remote code execution. | ||||
| CVE-2023-32628 | 1 Advantech | 1 Webaccess\/scada | 2025-01-08 | 7.2 High |
| In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution. | ||||
| CVE-2023-22450 | 1 Advantech | 1 Webaccess\/scada | 2025-01-08 | 7.2 High |
| In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution. | ||||
| CVE-2024-12854 | 2025-01-08 | 8.8 High | ||
| The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-12853 | 2025-01-08 | 8.8 High | ||
| The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-53345 | 2025-01-07 | 8.8 High | ||
| An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file. | ||||
| CVE-2025-21624 | 2025-01-07 | 9.8 Critical | ||
| ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239. | ||||
| CVE-2023-33498 | 1 Alist Project | 1 Alist | 2025-01-07 | 8.8 High |
| alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file. | ||||
| CVE-2023-33601 | 1 Phpok | 1 Phpok | 2025-01-07 | 8.8 High |
| An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file. | ||||
| CVE-2024-43243 | 1 Wordpress | 1 Wordpress | 2025-01-07 | 10 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGlow JobBoard Job listing allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through 1.2.6. | ||||
| CVE-2024-56829 | 2025-01-06 | 10 Critical | ||
| Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx. | ||||
| CVE-2023-34747 | 1 Ujcms | 1 Ujcms | 2025-01-06 | 9.8 Critical |
| File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. | ||||
| CVE-2023-27881 | 1 Ptc | 1 Vuforia Studio | 2025-01-06 | 8 High |
| A user could use the “Upload Resource” functionality to upload files to any location on the disk. | ||||