663 matches found
CVE-2026-5027
This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...
CiscoISE-CVE-2025-20282-POC
Cisco ISE CVE 2025-20282 Proof of concept Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ The python script abuses the upload function that is availible unauthenticated at /admin/files-upload/ The script locally creates a bin folder and a file named...
CVE-2026-34213
CVE-2026-34213 A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace. Intro I identified, responsibly disclosed, and reproduced a High-severity authorization flaw in Docmost , the...
CVE-2025-61506
An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint. Vulnerability: Unrestricted File Upload CWE-434 CVE ID: CVE-2025-61506 DISCOVRED : 18 september ASSIGNED : 9 october Affected Component:...
CVE-2026-113391
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclose...
CVE-2025-8889
Exploit Title: WordPress Compress Then Upload Plugin 1.0.3 Arbitrary File Upload to RCE Date: 2025-07-23 Exploit Author: Muhammed Çelik Vendor Homepage: https://wordpress.com/plugins/compress-then-upload Software Link: https://downloads.wordpress.org/plugin/compress-then-upload.latest-stable.zip...
CVE-2026-113391
A command injection vulnerability exists in the Upload Endpoint of the DrayTek Vigor2960 (version 1.5.1.6 Revision 8218). The flaw is located within the uploadlangs function of the /cgi-bin/mainfunction.cgi file. This vulnerability allows for remote execution of commands. Although the product is ...
CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclose...
EUVD-2026-104990
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclose...
CVE-2026-112247
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation ...
CVE-2026-112247 Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation ...
EUVD-2026-104527
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation ...
CVE-2026-112247
A weakness exists in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System (up to version 3.5 ) affecting the Upload Endpoint component. Specifically, an unknown function in the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx is vulnerable to Cro...
VulnCheck KEV: CVE-2026-112247
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation ...
CVE-2026-105032
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...
EUVD-2026-89096
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...
PT-2026-102904
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
CVE-2026-101071
A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...
CVE-2026-101071 Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload
A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...
EUVD-2026-88288
A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...