EUVD-2026-89096

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-34213

CVE-2026-34213 Un usuario de Docmost con pocos privilegios podría proporcionar un attachmentId de una víctima al endpoint de carga genérico y sobrescribir el archivo adjunto de otra página dentro del mismo espacio de trabajo. Introducción Identifiqué, divulgué responsablemente y reproduje una fal...

CVE-2026-101071

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

CVE-2026-101071 Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

CVE-2026-101071

The Acrel Electric Unet Web Service (up to version 20260814 ) is vulnerable to an unrestricted upload vulnerability within the Upload Endpoint . The flaw resides in the /exchange/attachment/upload file, where manipulation of the File argument allows for remote unauthorized uploads. Public exploit...

EUVD-2026-88288

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

CVE-2026-101071 Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

CVE-2026-101071: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

CVE-2026-100880

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It ...

CVE-2026-100880

The zhistaredu StarTraining software (versions up to 3.8.1 ) is vulnerable to Cross-Site Scripting (XSS) within the Upload Endpoint component. The root cause lies in the manipulation of the File argument within the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java. This vu...

CVE-2026-100880 zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It ...

CVE-2026-100880 zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It ...

EUVD-2026-88026

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It ...

CVE-2025-8889

Título del exploit: WordPress Compress Then Upload Plugin 1.0.3 — Subida arbitraria de archivos que conduce a RCE Fecha: 2025-07-23 Autor del exploit: Muhammed Çelik Página del proveedor: https://wordpress.com/plugins/compress-then-upload Enlace del software:...

CVE-2025-61506

Se descubrió un problema en MediaCrush hasta la versión 1.0.1 que permite a atacantes remotos no autenticados cargar archivos arbitrarios de cualquier tamaño en el endpoint /upload. Vulnerabilidad: Carga de archivos sin restricciones CWE-434 CVE ID: CVE-2025-61506 DESCUBRIDO : 18 de septiembre...

CVE-2026-100880: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It ...

CVE-2026-5027

Esta publicación es un artículo de investigación publicado por EQSTLab. Gracias aYahia Hamza, quien reportó y analizó esta vulnerabilidad. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Escritura Arbitraria de Archivos PoC ★ Descripción CVE-2026-5027: Vulnerabilidad de Escritura Arbitrar...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Prueba de concepto Informe: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ El script de Python abusa de la función de subida disponible sin autenticación en /admin/files-upload/ El script crea localmente una carpeta bin y un archivo...

CVE-2026-80156

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to...

CVE-2026-80156 Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to...