Unrestricted file upload.

Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

• bdthemes SigmaForms Pro – AI Generated Forms
• Unrestricted file upload

Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal

• Breeze Cache
• Unrestricted file upload

One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter

• onedesigns One User Avatar | User Profile Picture
• Unrestricted file upload

Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

• Roskus Prospero Flow CRM
• Unrestricted file upload

WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

• WP Manage Ninja Fluent Boards Pro
• Unrestricted file upload

Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

• Workeera
• Unrestricted file upload

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

• joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla
• Unrestricted file upload

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment

• wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
• Unrestricted file upload

Thinking Software Technology｜Efence - Arbitrary File Upload

• Thinking Software Technology Efence
• Unrestricted file upload

Thinking Software Technology｜EFence - Arbitrary File Upload

• Thinking Software Technology EFence
• Unrestricted file upload

CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload

• CAYIN Technology CAYIN CMS-WS
• CAYIN Technology CAYIN CMS-SE
• Unrestricted file upload

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS.

• Unrestricted file upload

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:

• Unrestricted file upload

An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file.

• Unrestricted file upload

ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints

• continew-org continew-admin
• Unrestricted file upload

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

• Unrestricted file upload

<1.8.2 · fixed in 1.8.2

Webkul QloApps improper file upload validation

• Webkul QloApps
• Unrestricted file upload

File Upload in TRTEK Software's Software Repository Management

• TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management
• Unrestricted file upload

CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action

• creativemindssolutions CM Map Locations – Visualize and share your locations in a few clicks
• Unrestricted file upload

Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

• vrana adminer
• Unrestricted file upload

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

• tophive UltimateAI
• Unrestricted file upload

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

• Roskus Prospero Flow CRM
• Unrestricted file upload

itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

• itsourcecode Online Pharmacy System
• Broken access control
• Unrestricted file upload

itsourcecode Payroll System admin_class.php save_settings unrestricted upload

• itsourcecode Payroll System
• Broken access control
• Unrestricted file upload

CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload

• CyberTutor NewSiteServer (NSS)
• Unrestricted file upload

xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

• 4xmen xshop
• Unrestricted file upload

CodeAstro Online Job Portal update-profile.php unrestricted upload

• CodeAstro Online Job Portal
• Broken access control
• Unrestricted file upload

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

• Path traversal
• Information disclosure

<2.1.5 · fixed in 2.1.5

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

• Cross-site scripting (XSS)
• Unrestricted file upload

>=6.0.0, <6.8.14 || >=7.0.0, <7.0.38 · fixed in 6.8.14, 7.0.38

Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

• Unrestricted file upload

>=6.0.0, <6.8.14 || >=7.0.0, <7.0.38 · fixed in 6.8.14, 7.0.38

) Missing Server-Side File Extension Validation in vsDesk

• vsDesk
• Unrestricted file upload

SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload

• SourceCodester Simple Online Food Ordering System
• Broken access control
• Unrestricted file upload

Remote Code Execution via Unrestricted File Upload in ATutor

• ATutor
• Unrestricted file upload

WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability

• themagnifico52 Warehouse Cargo
• Unrestricted file upload

WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

• themagnifico52 Smart Cleaning
• Unrestricted file upload

WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

• indithemes IT Residence
• Unrestricted file upload

WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

• David Lingren Media LIbrary Assistant
• Unrestricted file upload

Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.

• Frauscher Sensortechnik FDS 102
• Unrestricted file upload

Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

• Depicter — Popup & Slider Builder
• Unrestricted file upload

DeDeCMS select_media_post.php unrestricted upload

• DeDeCMS
• Broken access control
• Unrestricted file upload

Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

• wekan
• Unrestricted file upload

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

• Elementor Pro
• Unrestricted file upload

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3

• cmsjunkie.com J-BusinessDirectory extension for Joomla
• Unrestricted file upload

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

• yootheme.com Zoo extension for Joomla
• Unrestricted file upload

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

• Joomla! Project Joomla! CMS
• Joomla! Project Joomla! Framework Filesystem package
• Unrestricted file upload

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

• ThemeGrill Masteriyo - LMS
• Unrestricted file upload

WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability

• EDGE22 Studios Ltd. GP Premium
• Unrestricted file upload

WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

• wpWax Templatiq
• Unrestricted file upload

WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

• Kamlesh Parmar Sync Post With Other Site
• Unrestricted file upload

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

• Piotnet Addons For Elementor Pro
• Unrestricted file upload

OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload

• OpenBoxes
• Broken access control
• Unrestricted file upload

Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Unrestricted file upload

Unrestricted file upload in WordPress

• WordPress
• Unrestricted file upload

Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

• Progress ShareFile Storage Zones Controller
• Path traversal
• Unrestricted file upload

2100 Technology｜Official Document Management System - Arbitrary File Upload

• 2100 Technology Official Document Management System
• Unrestricted file upload

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code

• Unrestricted file upload

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document…

• Unrestricted file upload

ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override

• ProSolution WP Client
• Unrestricted file upload

Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

• daggerhart Query Wrangler
• Unrestricted file upload

Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb

• pandora
• Unrestricted file upload