Total
3618 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-55912 | 2 Clip-bucket, Oxygenz | 2 Clipbucket, Clipbucket | 2025-10-31 | 7.3 High |
| An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler | ||||
| CVE-2021-36741 | 2 Microsoft, Trendmicro | 5 Windows, Apex One, Officescan and 2 more | 2025-10-31 | 8.8 High |
| An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability. | ||||
| CVE-2022-27562 | 1 Hcltech | 1 Domino Leap | 2025-10-30 | 4.6 Medium |
| Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. | ||||
| CVE-2020-8260 | 1 Ivanti | 1 Connect Secure | 2025-10-30 | 7.2 High |
| A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction. | ||||
| CVE-2024-39717 | 1 Versa-networks | 1 Versa Director | 2025-10-30 | 7.2 High |
| The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. | ||||
| CVE-2022-42449 | 1 Hcltech | 1 Domino Leap | 2025-10-30 | 4.6 Medium |
| Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications | ||||
| CVE-2021-31207 | 1 Microsoft | 1 Exchange Server | 2025-10-30 | 6.6 Medium |
| Microsoft Exchange Server Security Feature Bypass Vulnerability | ||||
| CVE-2025-12291 | 1 Ashymuzuro | 2 Full-ecommece-website, Muzuro Ecommerce System | 2025-10-30 | 4.7 Medium |
| A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.php?add_product of the component Add Product Page. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-12344 | 1 Yonyou | 2 U8+, Yonyou | 2025-10-30 | 6.3 Medium |
| A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-6440 | 2 Jma Plugins, Wordpress | 2 Woocommerce Designer Pro, Wordpress | 2025-10-27 | 9.8 Critical |
| The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2025-11889 | 1 Wordpress | 1 Wordpress | 2025-10-27 | 7.2 High |
| The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.15. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2025-60735 | 1 Perfree | 1 Perfreeblog | 2025-10-27 | 7.6 High |
| PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function | ||||
| CVE-2025-60731 | 1 Perfree | 1 Perfreeblog | 2025-10-27 | 7.6 High |
| PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function | ||||
| CVE-2025-12201 | 1 Ajayrandhawa | 1 User-management-php-mysql | 2025-10-27 | 4.7 Medium |
| A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-56218 | 1 Ascertia | 1 Signinghub | 2025-10-27 | 9.8 Critical |
| An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file. | ||||
| CVE-2025-26350 | 1 Q-free | 1 Maxtime | 2025-10-24 | 4.9 Medium |
| A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests. | ||||
| CVE-2021-27860 | 1 Fatpipeinc | 6 Ipvpn, Ipvpn Firmware, Mpvpn and 3 more | 2025-10-24 | 9.8 Critical |
| A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006. | ||||
| CVE-2025-9841 | 2 Code-projects, Fabian | 2 Mobile Shop Management System, Mobile Shop Management System | 2025-10-23 | 6.3 Medium |
| A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2025-7175 | 1 Fabian | 1 E-commerce Site | 2025-10-23 | 6.3 Medium |
| A vulnerability was found in code-projects E-Commerce Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-12233 | 2 Fabian, Kashipara | 2 Online Notice Board, Online Notice Board System | 2025-10-23 | 7.3 High |
| A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /registration.php of the component Profile Picture Handler. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||