CVE-2026-49849

xShop is an open-source e-commerce platform built with Laravel . Version 3.0.3 contains an Unrestricted File Upload vulnerability in the File Attachment Module within the Admin panel. An authenticated administrator can upload executable files (e.g., .php), enabling Remote Code Execution (RCE) and...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-15530 WuzhiCMS Attachment API index.php listimage information disclosure

A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the component Attachment API. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. Th...

CVE-2026-15530

WuzhiCMS

EUVD-2004-1396

Malware in sbrugna...

Shopify Bug Bounty #8 - (FilePath) Cross Site Vulnerability

Document Title: =============== Shopify Bug Bounty 8 - FilePath Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1592 Release Date: ============= 2015-09-04 Vulnerability Laboratory ID VL-ID: ====================================...

phpcms 9.1.12 phpcms-modules-attachment-attachment.php sql注入

No description provided by source...

CVE-2004-1399

The CVE-2004-1399 entry concerns the phpBB Attachment module (version 2.3.10 and earlier). The underlying issue is a directory traversal vulnerability where an attacker can cause a filename to include .. to read arbitrary files. Impact is described as partial confidentiality (read access) with no...

phpbb2011.txt

Phpbb: All vulnerable all except 2.0.11 Attachment module: All version vulnerable Howdark update opened wide my eyes with his nice exploit: Bugtraq id: 10701 ----- viewtopic.php?t=1&highlight=%2527 ----- Looking at the code I saw that was possible inject any type of Sql query with a multiple char...

Phpbb id: 10701 update and Attachmodule add-on Directory Traversal

Phpbb: All vulnerable all except 2.0.11 Attachment module: All version vulnerable Howdark update opened wide my eyes with his nice exploit: Bugtraq id: 10701 ----- viewtopic.php?t=1&highlight=2527 ----- Looking at the code I saw that was possible inject any type of Sql query with a multiple char...