Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3543 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-47550 1 Themefic 1 Instantio 2025-05-12 6.6 Medium
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio allows Upload a Web Shell to a Web Server. This issue affects Instantio: from n/a through 3.3.16.
CVE-2022-3552 1 Boxbilling 1 Boxbilling 2025-05-12 7.2 High
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.
CVE-2025-4556 2025-05-12 9.8 Critical
The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVE-2025-3455 2025-05-12 8.8 High
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'start_restore' function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2025-4403 2025-05-12 9.8 Critical
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2025-4561 2025-05-12 8.8 High
The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVE-2020-26629 1 Phpgurukul 1 Hospital Management System 2025-05-09 9.8 Critical
A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.
CVE-2022-43283 1 Webassembly 1 Wabt 2025-05-08 5.5 Medium
wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.
CVE-2024-24350 1 Softwarepublico 1 E-sic Livre 2025-05-08 8.8 High
File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering component.
CVE-2024-22515 1 Ispyconnect 1 Agent Dvr 2025-05-08 8.8 High
Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio component.
CVE-2024-1261 1 Juanpao 1 Jpshop 2025-05-08 6.3 Medium
A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253000.
CVE-2025-23213 1 Tandoor 1 Recipes 2025-05-08 8.7 High
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
CVE-2024-25925 1 Sysbasics 1 Easy Checkout Field Editor 2025-05-08 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooCommerce Easy Checkout Field Editor, Fees & Discounts: from n/a through 3.5.12.
CVE-2024-25913 1 Skymoonlabs 1 Moveto 2025-05-08 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
CVE-2022-42198 1 Simple Exam Reviewer Management System Project 1 Simple Exam Reviewer Management System 2025-05-08 8.8 High
In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.
CVE-2022-31366 1 Eve-ng 1 Eve-ng 2025-05-08 7.2 High
An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file.
CVE-2022-42201 1 Simple Exam Reviewer Management System Project 1 Simple Exam Reviewer Management System 2025-05-08 7.2 High
Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
CVE-2024-25909 1 Joomunited 1 Wp Media Folder 2025-05-08 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
CVE-2024-7399 2 Samsung, Samsung Electronics 2 Magicinfo 9 Server, Magicinfo 9 Server 2025-05-08 8.8 High
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
CVE-2024-23759 1 Gambio 1 Gambio 2025-05-07 9.8 Critical
Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.