17313 matches found
CVE-2026-76157
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
CVE-2026-76157 Datiphy Data Management Center - Missing Authentication for Critical Function
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
CVE-2026-76157
Datiphy Data Management Center v8.3.0 through v8.5.1 has an unauthenticated upload API endpoint allowing remote attackers to upload arbitrary files, scoring CVSS 8.8 (HIGH) for integrity and availability impact. No exploitation evidence or patch details are provided; monitor the advisory at https...
EUVD-2026-63792
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
CVE-2026-76157 Datiphy Data Management Center - Missing Authentication for Critical Function
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
PT-2026-79286
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
CVE-2026-76157: Missing Authentication for Critical Function
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...
Arbitrary File Upload
Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Arbitrary File Upload via the SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only...
Arbitrary File Upload
Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Arbitrary File Upload via the HasUploadFields process. An attacker can execute arbitrary code on the server by uploading a file...
CVE-2026-2334
vsDesk v14.0101 is affected by a missing server-side file extension validation in the "Import via CSV" component. An authenticated attacker with administrative privileges can bypass client-side validation to upload an arbitrary file, leading to Remote Code Execution (RCE) within the web applicati...
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
On July 24th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with an estimated 6,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
CVE-2026-74016
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74014
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CVE-2026-66600
Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...
CVE-2026-74018
CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...
CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
EUVD-2026-63318
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...