Total
3110 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-22895 | 1 Dedecms | 1 Dedecms | 2025-06-05 | 8.8 High |
| DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php. | ||||
| CVE-2024-11391 | 2 Advancedfilemanager, Modalweb | 2 Advanced File Manager, Advanced File Manager | 2025-06-05 | 7.5 High |
| The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-47151 | 1 Honor | 1 Magicos | 2025-06-05 | 6.3 Medium |
| Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution | ||||
| CVE-2024-13333 | 1 Advancedfilemanager | 1 Advanced File Manager | 2025-06-05 | 7.5 High |
| The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled. | ||||
| CVE-2023-5604 | 1 Asgaros | 1 Asgaros Forum | 2025-06-05 | 9.8 Critical |
| The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution. | ||||
| CVE-2023-4225 | 1 Chamilo | 2 Chamilo, Chamilo Lms | 2025-06-05 | 8.8 High |
| Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. | ||||
| CVE-2025-47577 | 2025-06-05 | 10 Critical | ||
| Unrestricted Upload of File with Dangerous Type vulnerability in TemplateInvaders TI WooCommerce Wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a before 2.10.0. | ||||
| CVE-2024-40744 | 2 Convert Forms Project, Tassosgr | 2 Convert Forms, Convert Forms | 2025-06-04 | 9.8 Critical |
| Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8. | ||||
| CVE-2025-46078 | 1 Huocms | 1 Huocms | 2025-06-04 | 5.3 Medium |
| HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server | ||||
| CVE-2025-46080 | 1 Huocms | 1 Huocms | 2025-06-04 | 5.3 Medium |
| HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server. | ||||
| CVE-2024-11000 | 1 Codeastro | 1 Real Estate Management System | 2025-06-04 | 4.7 Medium |
| A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutedit.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-10999 | 1 Codeastro | 1 Real Estate Management System | 2025-06-04 | 4.7 Medium |
| A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-40400 | 1 Automad | 1 Automad | 2025-06-04 | 8.8 High |
| An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. | ||||
| CVE-2024-23180 | 1 Appleple | 1 A-blog Cms | 2025-06-04 | 8.8 High |
| Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary code by uploading a specially crafted SVG file. | ||||
| CVE-2025-45855 | 2025-06-04 | 5.4 Medium | ||
| An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file. | ||||
| CVE-2025-48953 | 2025-06-04 | 5.5 Medium | ||
| Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available. | ||||
| CVE-2025-1725 | 2025-06-04 | 6.4 Medium | ||
| The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | ||||
| CVE-2022-38887 | 1 D8s-python Project | 1 D8s-python | 2025-06-03 | 9.8 Critical |
| The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0. | ||||
| CVE-2022-38877 | 1 Garage Management System Project | 1 Garage Management System | 2025-06-03 | 7.2 High |
| Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action/editProductImage.php?id=1. | ||||
| CVE-2025-5131 | 1 Project Team | 1 Tmall Demo | 2025-06-03 | 4.7 Medium |
| A vulnerability was found in Tmall Demo up to 20250505. It has been declared as critical. This vulnerability affects the function uploadCategoryImage of the file tmall/admin/uploadCategoryImage. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||