Total
4125 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-29624 | 1 Tpcms Project | 1 Tpcms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-29623 | 1 Connect-multiparty Project | 1 Connect-multiparty | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report. | |||||
| CVE-2022-29622 | 1 Formidable Project | 1 Formidable | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability. | |||||
| CVE-2022-29451 | 1 Rarathemes | 1 Rara One Click Demo Import | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory. | |||||
| CVE-2022-29354 | 1 Keystonejs | 1 Keystone | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file. | |||||
| CVE-2022-29353 | 1 Graphql-upload Project | 1 Graphql-upload | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename. | |||||
| CVE-2022-29318 | 1 Car Rental Management System Project | 1 Car Rental Management System | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-29001 | 1 Springbootmovie Project | 1 Springbootmovie | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability | |||||
| CVE-2022-28927 | 1 Subconverter Project | 1 Subconverter | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters. | |||||
| CVE-2022-28863 | 1 Nokia | 1 Netact | 2026-06-17 | N/A | 8.8 HIGH |
| An issue was discovered in Nokia NetAct 22. A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the operation=upload value. | |||||
| CVE-2022-28700 | 1 Givewp | 1 Givewp | 2026-06-17 | N/A | 9.1 CRITICAL |
| Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | |||||
| CVE-2022-28606 | 1 Bosscms | 1 Bosscms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server. | |||||
| CVE-2022-28528 | 1 Bloofox | 1 Bloofoxcms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit. | |||||
| CVE-2022-28525 | 1 Ed01-cms Project | 1 Ed01-cms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_user&id=1. | |||||
| CVE-2022-28440 | 1 Ucms Project | 1 Ucms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-28372 | 1 Verizon | 4 Lvskihp Indoorunit, Lvskihp Indoorunit Firmware, Lvskihp Outdoorunit and 1 more | 2026-06-17 | N/A | 7.5 HIGH |
| On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file upload to the device. This occurs in /lib/lua/luci/crtc.lua (IDU) and /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh (ODU). | |||||
| CVE-2022-28369 | 1 Verizon | 2 Lvskihp Indoorunit, Lvskihp Indoorunit Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the local network can provide a malicious URL. The data (found at that URL) is written to /usr/sbin/dropbear and then executed as root. | |||||
| CVE-2022-28223 | 1 Tekon | 16 Kio, Kio-1m, Kio-1m Firmware and 13 more | 2026-06-17 | 9.0 HIGH | 9.1 CRITICAL |
| Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin. | |||||
| CVE-2022-28120 | 1 Rainier | 1 Open Virtual Simulation Experiment Teaching Management Platform | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server. | |||||
| CVE-2022-28104 | 2 Apple, Foxit | 2 Iphone Os, Pdf Editor | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability. | |||||