17321 matches found
CVE-2026-33560: Unrestricted Upload of File with Dangerous Type
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and...
CVE-2026-57658: Unrestricted Upload of File with Dangerous Type
Administrator Arbitrary File Upload in TemplateSpare = 4.2.0 versions...
CVE-2026-56059: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Travel Booking = 2.2.5 versions...
PT-2026-52828
Name of the Vulnerable Software and Affected Versions TemplateSpare versions 4.2.0 and earlier Description An issue allows an administrator to perform an arbitrary file upload. This means a user with high privileges can upload files of any type to the server, which could potentially lead to remot...
CVE-2026-56058: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Quform = 2.23.0 versions...
PT-2026-52743
Customer Arbitrary File Upload in Booster for WooCommerce = 8.0.1 versions...
PT-2026-52766
Subscriber Arbitrary File Upload in Travel Booking = 2.2.5 versions...
PT-2026-52989
Name of the Vulnerable Software and Affected Versions DMP-5000 affected versions not specified Description The file service allows authenticated users to upload files of any type without validation. The system does not enforce file extension filtering or content inspection, which enables the uplo...
CVE-2026-56027: Unrestricted Upload of File with Dangerous Type
Customer Arbitrary File Upload in Booster for WooCommerce = 8.0.1 versions...
CVE-2025-71333 Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...
CVE-2025-71333 Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...
CVE-2025-71333 Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...
CVE-2026-57700
CVE-2026-57700 is an unrestricted file upload vulnerability in the WordPress plugin OMGF Pro by Daan.Dev, affecting versions through 5.2.6 . Discovered by NETZLICHT , the flaw allows unauthenticated attackers to upload malicious files of dangerous types, leading to remote code execution (RCE) on ...
CVE-2026-57700 WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6...
CVE-2026-57700 WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6...
WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by NETZLICHT in WordPress Plugin OMGF Pro versions = 5.2.6...
WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Theme Travel Booking versions = 2.2.5...
WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Quform versions = 2.23.0...
CVE-2025-71333: External Control of File Name or Path
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...
