16513 matches found
CVE-2026-86437: Incorrect Authorization
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...
Exploit for CVE-2026-75865
CVE-2026-75865 Proof-of-concept and technical write-up for...
CVE-2026-75169
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...
cve-disclosures
CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE...
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 CVSS score: 9.8 - A missing file type validation vulnerability in Super Forms – Drag & Drop Form...
EUVD-2026-71712
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...
CVE-2026-75169: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...
CVE-2026-78839
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...
CVE-2026-75169
The MBS-Solutions X-Serie Gateway running firmware V6_00_05 is affected by an arbitrary file upload vulnerability in the /cgi-bin/ugwupload.cgi component. A remote authenticated user with the Admin role can exploit this flaw to upload files containing arbitrary content to hardcoded paths . No spe...
CVE-2026-75169
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...
PT-2026-86238
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...
CVE-2026-75169
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...
CVE-2026-78839
AppNitro MachForm v30 is vulnerable to an arbitrary file upload vulnerability that enables remote code execution . An unauthenticated attacker can exploit this by uploading a crafted .phar file to a form that permits that extension. Successful exploitation requires the attacker to identify a form...
EUVD-2026-71444
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...
CVE-2026-78839: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...
CVE-2025-9314
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the extract process. An attacker can execute arbitrary PHP code on the server by uploading a ZIP archive containing PHP-executable files and extracting them into a web-accessible directory. This is only...
CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...