CVE-2026-105649

The Ghost Node.js content management system is vulnerable to Stored Cross-Site Scripting (XSS) in versions 4.22.0 through 6.65.0 . The root cause is a lack of sanitization for SVG media thumbnails and SVG images uploaded using non-SVG file extensions. This flaw allows any staff user, including Co...

CVE-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.6 - Unauthenticated Direct File Access vulnerability

Unauthenticated Direct File Access vulnerability discovered by J4ck13Ch4n in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.6...

WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.5 - Unauthenticated Customer Uploaded File Disclosure vulnerability

Unauthenticated Customer Uploaded File Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.5...

Astra Linux – Vulnerability in Tomcat9

Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...

CVE-2026-78371

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-78371 File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

EUVD-2026-92261

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin, in versions through 1.7.6 , is vulnerable to unauthenticated direct file access. The root cause is that customer-uploaded files are stored in a publicly web-accessible uploads directory where the plugin's intended access restrictions are in...

CVE-2026-78371 File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

EUVD-2026-92262

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-78371

The File Uploads Addon for WooCommerce WordPress plugin versions before 1.7.6 contains a vulnerability where it fails to verify the identity of users requesting customer-uploaded files. This lack of authorization allows unauthenticated attackers to download files belonging to other customers if t...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - Authentifizierte RCE in Chyrp Lite ≤ 2026.01 "Iriomote" Verketteter Angriff: Umgehung der Blocklist für uploadspath CVE-2026-53768 + fehlende Dateiendungsvalidierung in adminupdateupload CVE-2026-53767 → Remote Code Execution als www-data...

PT-2026-104730

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-78371: Authorization Bypass Through User-Controlled Key

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

PT-2026-104729

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-13607: Improper Access Control

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...