CVE-2025-32370

CRITICAL Year: 2025
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-912
View all →

Vulnerability Description

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.

Related Vulnerabilities

CVE-2020-12504

CRITICAL
CVSS:9.8(Critical)

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT...

CWE-9122020

CVE-2020-14487

CRITICAL
CVSS:9.8(Critical)

OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitr...

CWE-9122020

CVE-2020-16204

CRITICAL
CVSS:9.8(Critical)

The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versi...

CWE-9122020

CVE-2021-24867

CRITICAL
CVSS:9.8(Critical)

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are af...

CWE-9122021

CVE-2021-43987

CRITICAL
CVSS:9.8(Critical)

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regu...

CWE-9122021

CVE-2022-3203

CRITICAL
CVSS:9.8(Critical)

On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get ...

CWE-9122022