deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-54820
Published: 2025-02-24
Description: XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attackers to extract all usernames and passwords via a crafted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jcarabantes/CVE-2024-54820; https://xone.es/; https://github.com/jcarabantes/CVE-2024-54820
CVE: CVE-2024-57026
Published: 2025-02-24
Description: TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cosmosofcyberspace.github.io/tawk_to_cve.html
CVE: CVE-2025-27112
Published: 2025-02-24
Description: Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0; https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p
CVE: CVE-2025-27133
Published: 2025-02-24
Description: WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adicionar_tipo_exame.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.2.15 contains a patch for the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/619ead748e18e685459c6dc3c226e621b9ff5403; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xj79-w799-qjcp
CVE: CVE-2025-27364
Published: 2025-02-24
Description: In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web request to the Caldera server API used for compiling and downloading of Caldera's Sandcat or Manx agent (implants). This web request can use the gcc -extldflags linker flag with sub-commands.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://github.com/mitre/caldera/commit/35bc06e42e19fe7efbc008999b9f993b1b7109c0; https://github.com/mitre/caldera/pull/3129; https://github.com/mitre/caldera/pull/3131/commits/61de40f92a595bed462372a5e676c2e5a32d1050
CVE: CVE-2025-26525
Published: 2025-02-24
Description: Insufficient sanitizing in the TeX notation filter resulted in an 
arbitrary file read risk on sites where pdfTeX is available (such as 
those with TeX Live installed).
CVSS Score: 8.6 (HIGH)
CWE: CWE-552
References: https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136; https://moodle.org/mod/forum/discuss.php?d=466141
CVE: CVE-2025-26526
Published: 2025-02-24
Description: Separate Groups mode restrictions were not factored into permission 
checks before allowing viewing or deletion of responses in Feedback 
activities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79976; https://moodle.org/mod/forum/discuss.php?d=466142
CVE: CVE-2025-26527
Published: 2025-02-24
Description: Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1230
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83941; https://moodle.org/mod/forum/discuss.php?d=466143
CVE: CVE-2025-26528
Published: 2025-02-24
Description: The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
CVSS Score: 3.4 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82896; https://moodle.org/mod/forum/discuss.php?d=466144
CVE: CVE-2025-26529
Published: 2025-02-24
Description: Description information displayed in the site administration live log 
required additional sanitizing to prevent a stored XSS risk.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84145; https://moodle.org/mod/forum/discuss.php?d=466145
CVE: CVE-2025-26530
Published: 2025-02-24
Description: The question bank filter required additional sanitizing to prevent a reflected XSS risk.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84146; https://moodle.org/mod/forum/discuss.php?d=466146
CVE: CVE-2025-26531
Published: 2025-02-24
Description: Insufficient capability checks made it possible to disable badges a user does not have permission to access.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84239; https://moodle.org/mod/forum/discuss.php?d=466148
CVE: CVE-2025-26532
Published: 2025-02-24
Description: Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84003; https://moodle.org/mod/forum/discuss.php?d=466149
CVE: CVE-2025-26533
Published: 2025-02-24
Description: An SQL injection risk was identified in the module list filter within course search.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84271; https://moodle.org/mod/forum/discuss.php?d=466150
CVE: CVE-2025-27137
Published: 2025-02-24
Description: Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. Templates are evaluated using the Pebble template engine. Pebble supports an `include` tag, which allows template authors to include the content of arbitrary files upon evaluation. Prior to version 4.12.6, users of Dependency-Track with the `SYSTEM_CONFIGURATION` permission can abuse the `include` tag by crafting notification templates that `include` sensitive local files, such as `/etc/passwd` or `/proc/1/environ`. By configuring such a template for a notification rule (aka "Alert"), and having it send notifications to a destination controlled by the actor, sensitive information may be leaked. The issue has been fixed in Dependency-Track 4.12.6. In fixed versions, the `include` tag can no longer be used. Usage of the tag will cause template evaluation to fail. As a workaround, avoid assigning the `SYSTEM_CONFIGURATION` permission to untrusted users. The `SYSTEM_CONFIGURATION` permission per default is only granted to members of the `Administrators` team. Assigning this permission to non-administrative users or teams is a security risk in itself, and highly discouraged.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-73
References: https://github.com/DependencyTrack/dependency-track/pull/4684; https://github.com/DependencyTrack/dependency-track/pull/4685; https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-9582-88hr-54w3
CVE: CVE-2024-57608
Published: 2025-02-24
Description: An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Zkplo/AppVulHub/blob/main/mark.via.Shell/CWE-94.md; https://github.com/Zkplo/AppVulHub/blob/main/mark.via.Shell/CWE-94.md
CVE: CVE-2025-25513
Published: 2025-02-24
Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-1.md
CVE: CVE-2025-27140
Published: 2025-02-24
Description: WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, `importar_dump.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. The command is basically a command to move a temporary file, so a webshell upload is also possible. Version 3.2.15 contains a patch for the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-284, CWE-78
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/7d0df8c9a0b8b7d6862bbc23dc729d73e39672a1; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xw6w-x28r-2p5c
CVE: CVE-2025-27141
Published: 2025-02-24
Description: Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see results of cached questions, even if their permissions don’t allow them to see the data. If some user runs a question which gets cached, and then an impersonated user runs that question, then the impersonated user sees the same results as the previous user. These cached results may include data the impersonated user should not have access to. This vulnerability only impacts the Enterprise Edition of Metabase and not the Open Source Edition. Versions 1.53.2, 1.52.11, 1.51.14, and 1.50.36 contains a patch. Versions on the 1.49.X, 1.48.X, and 1.47.X branches are vulnerable but do not have a patch available, so users should upgrade to a major version with an available fix. Disabling question caching is a workaround for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/metabase/metabase/security/advisories/GHSA-6cc4-h534-xh5p; https://www.metabase.com/docs/latest/configuring-metabase/caching; https://www.metabase.com/docs/latest/permissions/impersonation
CVE: CVE-2024-53542
Published: 2025-02-24
Description: Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://secure77.de/smart-time-plus-rce-cve-2024-53543/
CVE: CVE-2024-53543
Published: 2025-02-24
Description: NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smarttimeplus/MySQLConnection endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://secure77.de/smart-time-plus-rce-cve-2024-53543/
CVE: CVE-2024-53544
Published: 2025-02-24
Description: NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the smarttimeplus/MySQLConnection endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://secure77.de/smart-time-plus-rce-cve-2024-53543/
CVE: CVE-2024-56525
Published: 2025-02-24
Description: In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://openjournaltheme.com/user-xml-fatal-vulnerabilities-for-ojs-omp-ops-3-3-0-21-cve-2024-56525/
CVE: CVE-2024-57685
Published: 2025-02-24
Description: An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/lhRaMk7/notebook/blob/main/phar_rce
CVE: CVE-2025-22974
Published: 2025-02-24
Description: SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/[PII_REDACTED]06/CVE/blob/master/seacms/CVE-2025-22974.md
CVE: CVE-2025-27143
Published: 2025-02-24
Description: Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens. This CVE is a bypass of the fix for GHSA-8jhw-6pjj-8723/CVE-2024-56734. Version 1.1.21 contains an updated patch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c[PII_REDACTED]; https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80; https://github.com/better-auth/better-auth/releases/tag/v1.1.21
CVE: CVE-2025-27144
Published: 2025-02-24
Description: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.
CWE: CWE-770
References: https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22; https://github.com/go-jose/go-jose/releases/tag/v4.0.5; https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78
CVE: CVE-2025-1640
Published: 2025-02-25
Description: A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS_PESSOAIS_PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc&_=[PII_REDACTED]95. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/yago3008/CVES; https://vuldb.com/?ctiid.296690; https://vuldb.com/?id.296690
CVE: CVE-2025-1641
Published: 2025-02-25
Description: A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0&_=[PII_REDACTED]97. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.296691; https://vuldb.com/?id.296691
CVE: CVE-2025-1642
Published: 2025-02-25
Description: A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-99
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.296692; https://vuldb.com/?id.296692
CVE: CVE-2025-1643
Published: 2025-02-25
Description: A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SG_AlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.296693; https://vuldb.com/?id.296693
CVE: CVE-2025-1644
Published: 2025-02-25
Description: A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar. The manipulation of the argument idItAg leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 1.2.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.296694; https://vuldb.com/?id.296694
CVE: CVE-2025-1645
Published: 2025-02-25
Description: A vulnerability classified as critical was found in Benner Connecta 1.0.5330. Affected by this vulnerability is an unknown functionality of the file /Usuarios/Usuario/EditarLogado/. The manipulation of the argument Handle leads to improper control of resource identifiers. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-99
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.296695; https://vuldb.com/?id.296695
CVE: CVE-2025-27145
Published: 2025-02-25
Description: copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the same privileges as that user. For example, this could give unintended read-access to files owned by that user. The bug is triggered by the drag-drop action itself; it is not necessary to actually initiate the upload. The file must be empty (zero bytes). Note that, as a general-purpose webserver, it is intentionally possible to upload HTML-files with arbitrary javascript in `<script>` tags, which will execute when the file is opened. The difference is that this vulnerability would trigger execution of javascript during the act of uploading, and not when the uploaded file was opened. Version 1.16.15 contains a fix.
CVSS Score: 3.6 (LOW)
CWE: CWE-79, CWE-83
References: https://github.com/9001/copyparty/commit/438ea6ccb06f39d7cbb4b6ee7ad44606e21a63dd; https://github.com/9001/copyparty/releases/tag/v1.16.15; https://github.com/9001/copyparty/security/advisories/GHSA-m2jw-cj8v-937r
CVE: CVE-2025-1646
Published: 2025-02-25
Description: A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx of the component ASPX File Handler. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434
References: https://github.com/Rain1er/report/blob/main/Lserp/fileUpload_3.md; https://vuldb.com/?ctiid.296696; https://vuldb.com/?id.296696
CVE: CVE-2024-10545
Published: 2025-02-25
Description: The Photo Gallery, Sliders, Proofing and   WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e969e5f8-17cb-489b-988d-cae31719da36/
CVE: CVE-2025-22210
Published: 2025-02-25
Description: A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22210; https://www.hikashop.com/; https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22210
CVE: CVE-2025-1063
Published: 2025-02-25
Description: The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3241883/classified-listing; https://www.wordfence.com/threat-intel/vulnerabilities/id/e701b771-59f2-4783-b0a1-bea4d6c3d245?source=cve
CVE: CVE-2025-1128
Published: 2025-02-25
Description: The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/wpeverest/everest-forms/commit/7d37858d2c614aa107b0f495fe50819a3867e7f5; https://github.com/wpeverest/everest-forms/pull/1406/files; https://plugins.trac.wordpress.org/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#file0