CVE-2026-2334 ) Missing Server-Side File Extension Validation in vsDesk

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

CVE-2026-2334

vsDesk v14.0101 is affected by a missing server-side file extension validation in the "Import via CSV" component. An authenticated attacker with administrative privileges can bypass client-side validation to upload an arbitrary file, leading to Remote Code Execution (RCE) within the web applicati...

CVE-2026-2334 ) Missing Server-Side File Extension Validation in vsDesk

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

EUVD-2026-63566

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

GHSA-RRWH-6JRQ-WP5V Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiv...

EUVD-2026-42235

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import...

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiv...

CVE-2026-64965

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-64968

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-64968 Server-Side Request Forgery in ATutor

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

EUVD-2026-63369

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-64968 Server-Side Request Forgery in ATutor

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-64968

ATutor's import functionalities allow an authenticated administrator to perform Server-Side Request Forgery, reaching arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// when PHP URL wrappers are enabled. The product is no longer supported and remains unpatched;...

EUVD-2026-63366

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-64965

ATutor 2.2.4 lacks authorization checks on test and question import endpoints, letting a low-privileged authenticated student bypass access controls and import content into a course. The product is no longer actively supported; no patch exists. No in-the-wild exploitation is reported. Migration t...

CVE-2026-64965 Missing Authorization Check in ATutor

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-64965 Missing Authorization Check in ATutor

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

WordPress Solace Extra plugin <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action vulnerability

Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Solace Extra versions = 1.6.0...

WordPress All-in-One WP Migration and Backup plugin < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability discovered by Mohamed Bassia in WordPress Plugin All-in-One WP Migration versions 7.108...

WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability

Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...