EUVD-2026-114229

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

CVE-2026-115346 Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

CVE-2026-115346

The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to unauthenticated arbitrary file upload in versions up to and including 7.16.2 . The flaw exists in the convert_palette_images_to_truecolor() function due to insufficient file type validation during the processing of upl...

CVE-2026-104739 JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

CVE-2026-104739

The JS Help Desk WordPress plugin (all versions up to and including 5.0.1 ) is vulnerable to arbitrary file deletion due to a path traversal flaw in the setSupportCustomImage function. This issue stems from insufficient file path validation of the support_custom_img parameter. Authenticated attac...

EUVD-2026-114222

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

CVE-2026-104739 JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

CVE-2022-29464

CVE-2022-29464 A preauth arbitrary file upload that leads to RCE in WSO2 Summary of the CVE CVE-2022-29464 is a RCE vulnerability for WSO2 discovered by Orange Tsai. A unauthenticated arbitrary file upload allows an attacker to execute code by uploading a malicious JSP file. Affected Versions WSO...

CVE-2024-2961

CVE-2024-2961 Uses CVE-2024-2961 to perform an arbitrary file read Usage Use with wrapwrap for maximum potency. usage: arbitrary-file-read.py -h -t TARGET -c CHAIN -ct CONTENTTYPE --prefix-len PREFIXLEN --suffix-len SUFFIXLEN options: -h, --help show this help message and exit -t TARGET, --target...

CVE-2023-35843

CVE-2023-35843 CVE-2023-35843 Arbitrary File Read Vulnerability...

CVE-2025-57176

CVE-2025-57176 CVE-2025-57176 - Siklu EtherHaul Series - Unauthenticated Arbitrary File Upload Affected Versions: Firmware 7.4.0 - 10.7.3 likely all versions since 7.4.0...

CVE-2021-21402

CVE-2021-21402 Jellyfin Arbitrary File Read Vulnerability Overview Jellyfin is a free software media system that controls and manages media and streaming. It is an alternative to Emby and Plex, delivering media from a dedicated server to end-user devices through multiple applications. Jellyfin...

WSO2-2021-1260

WSO2-2021-1260: Deletion of Arbitrary files via Path Traversal in Artifact Name in WSO2 ESB Due to the unsanitized user input in the Artifact Upload feature, an arbitrary file deletion attack could be carried out by leveraging path traversal in the "artifactName" parameter. Vendor Disclosure: The...

CVE-2020-3452_Cisco_ASA_PathTraversal

CVE-2020-3452CiscoASAPathTraversal Proof-of-concept script for CVE-2020-3452 — Cisco ASA/FTD Path Traversal vulnerability. Supports automated extraction of known file targets with a hard limit on successful downloads for safety. Intended for authorized security testing and research purposes only....

CVE-2026-119291

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2025-8081-Elementor

CVE-2025-8081 - Elementor Arbitrary File Read Vulnerability A critical arbitrary file read vulnerability in Elementor WordPress plugin that allows authenticated administrators to read any file accessible by the web server, including sensitive configuration files containing database credentials. 📋...

TotalCMS-Arbitrary_File-Upload--XSS_Steal_Cookies---TotalDepot

TotalCMS Arbitrary File Upload - XSS and steal cookies Author: Sergio Description: TotalCMS is affected by Arbitrary File Upload - XSS vulnerability which allows Cross-Site Scriting XSS and also stealing session cookies Attack Vectors: A vulnerability in "Total Depot" file upload sanitation allow...

EUVD-2026-114137

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2026-119291 zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2026-119291

Prior to version 1.4.0 , the @zuke/cli component of the Zuke build automation system for Deno is vulnerable to a symlink attack (CWE-59 ). While the tool uses lstat to inspect scaffold names, it performs link-following reads, writes, and permission changes during zuke setup and zuke import operat...