Arbitrary File Upload

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Arbitrary File Upload through the Admin API /files/upload endpoint in ghost/core/core/server/api/endpoints/files.js. An attacker can make uploaded files be served with an attacker-chosen content type by...

Exploit for CVE-2026-48908

CVE-2026-48908 — SP Page Builder Unauthenticated RCE SP Pag...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through a multi-stage chain involving the download, getmediacontent, getcurrentuser, restore, and post processes. An attacker can gain unauthorized access, escalate privileges, read arbitrary files, and execute...

WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jakub Herman in WordPress Plugin Booster for WooCommerce versions = 8.0.1...

VulnCheck KEV: CVE-2025-7443

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the storejavascriptcache.php file in all versions up to, and including, 2.2.4...

EUVD-2025-26130

Paymenter vulnerable to Remote Code Execution via public file uploads...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the ticket attachments process. An attacker can execute arbitrary code, extract sensitive data, read credentials, and run system commands by uploading malicious files as an authenticated user. Workaround This...

Exploit for CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE...

CVE-2026-48500: Missing Authorization

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, so...

CVE-2026-48939

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

EUVD-2026-38110

A vulnerability in the SP Page Builder for Joomla allows the upload of arbitrary files for unauthenticated users, ultimately resulting in PHP code upload and execution...

CVE-2026-48908 Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...

CVE-2026-48908

CVE-2026-48908 affects the Joomla extension SP Page Builder (com_sppagebuilder). Reports and PoCs confirm unauthenticated file upload via the asset.uploadCustomIcon task, allowing arbitrary files to be written to the webroot and potentially executing PHP code. Affected versions are 1.0.0 through ...

EUVD-2026-38109

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-48939

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-48939

The CVE-2026-48939 issue affects iCagenda/Joomla. The vulnerability is in the frontend event submission form’s file attachment feature, where missing access control and lack of file validation allow unauthenticated uploads that are written to a web‑accessible directory and can be executed as PHP,...

PT-2026-51137

Name of the Vulnerable Software and Affected Versions iCagenda versions prior to 4.0.8 iCagenda versions prior to 3.9.15 Description A flaw in the iCagenda extension for Joomla allows unauthenticated users to upload arbitrary files through the attachment feature of the public event submission for...

CVE-2026-48908: Unrestricted Upload of File with Dangerous Type

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...