Lucene search
+L

46293 matches found

EUVD
EUVD
added 6 hours ago6 views

EUVD-2026-52252

Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and uploa...

6.9CVSS5.6AI score
SaveExploits0References3
CVE
CVE
added 8 hours ago11 views

CVE-2026-16250

The CVE describes a flaw in the Personal QR Message WordPress plugin (version ≤ 1.0) where an unauthenticated handler does not restrict uploaded file types, enabling unauthenticated users to upload arbitrary executable PHP files that are directly reachable, which leads to remote code execution. T...

6AI score
SaveExploits0References1
CVE
CVE
added 8 hours ago5 views

CVE-2026-12872

The CVE-2026-12872 entry concerns the Webinfos WordPress plugin (≤ 1.2). The core issue is that the plugin does not validate upload file type/name and does not enforce authentication, capability checks, or nonces for uploads. This allows unauthenticated attackers to upload arbitrary files (includ...

6.6AI score
SaveExploits0References1
Nuclei
Nuclei
added 10 hours ago98 views

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

10CVSS8.1AI score0.05128EPSS
SaveExploits2References3
Nuclei
Nuclei
added 10 hours ago32 views

Cockpit < 2.4.1 - Arbitrary File Upload

Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter. id: CVE-2025-1025 info: name: Cockpit 2.4.1 - Arbitrary File Upload author: iamnoooob,rootxharsh,pdresearch severity: high...

8.7CVSS7.2AI score0.19493EPSS
SaveExploits0References2
Nuclei
Nuclei
added 10 hours ago27 views

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

9.8CVSS8.6AI score0.06944EPSS
SaveExploits1References4
Nuclei
Nuclei
added 10 hours ago20 views

WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. id: CVE-2021-3462...

9.8CVSS7.7AI score0.06744EPSS
SaveExploits2References1
Nuclei
Nuclei
added 10 hours ago99 views

WordPress Imagements <=1.2.5 - Arbitrary File Upload

WordPress Imagements plugin through 1.2.5 is susceptible to arbitrary file upload which can lead to remote code execution. The plugin allows images to be uploaded in comments but only checks for the Content-Type in the request to forbid dangerous files. An attacker can upload arbitrary files by...

9.8CVSS8.2AI score0.0714EPSS
SaveExploits2References4
Nuclei
Nuclei
added 10 hours ago414 views

WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the uploadpostimage function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload...

9.8CVSS8.5AI score0.12749EPSS
SaveExploits3References5
Nuclei
Nuclei
added 10 hours ago259 views

Weaver E-Office 9.5 - Remote Code Execution

A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit h...

9.8CVSS6.4AI score0.32895EPSS
SaveExploits4References5
Nuclei
Nuclei
added 10 hours ago25 views

Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload

A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portaladminupload.cgi, with the changes reflected at...

8.8CVSS7.6AI score0.0205EPSS
SaveExploits1References3
Nuclei
Nuclei
added 10 hours ago20 views

WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload

WordPress midi-Synth plugin \u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to...

9.8CVSS5.8AI score0.04458EPSS
SaveExploits1References1
Nuclei
Nuclei
added 10 hours ago32 views

WP Mobile Detector <= 3.5 - Unrestricted File Upload

WP Mobile Detector plugin for WordPress = 3.5 contains an unrestricted file upload vulnerability caused by missing file type validation in resize.php, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution. id: CVE-2016-15043 info: name: WP Mobile...

9.8CVSS5.9AI score0.10032EPSS
SaveExploits1References3
Nuclei
Nuclei
added 10 hours ago14 views

VvvebJs <= 2.0.5 - Cross-Site Scripting

Givanz Vvvebjs = 2.0.5 contains a stored XSS caused by manipulation of the "uploadAllowExtensions" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2026-5615 info: name: VvvebJs = 2.0.5 - Cross-Site Scripting author:...

5.3CVSS5.5AI score0.00773EPSS
SaveExploits1References2
Nuclei
Nuclei
added 10 hours ago105 views

LyLme-Spage - Arbitary File Upload

An arbitrary file upload vulnerability in the component /include/file.php of lylmespage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-34982 info: name: LyLme-Spage - Arbitary File Upload author: DhiyaneshDk severity: high description: | An arbitrary...

9.8CVSS6AI score0.04675EPSS
SaveExploits1References3
Nuclei
Nuclei
added 10 hours ago150 views

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...

9.8CVSS6.9AI score0.70688EPSS
SaveExploits1References5
Nuclei
Nuclei
added 10 hours ago85 views

Z-Downloads < 1.11.7 - Cross-Site Scripting

The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. id: CVE-2024-8673 info: name: Z-Downloads 1.11.7 - Cross-Site Scripting author: Splint3r7 severity: low description: | The plugin does not properly validate uploaded files...

9.1CVSS5.4AI score0.01618EPSS
SaveExploits1References1
Nuclei
Nuclei
added 10 hours ago70 views

Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

9.8CVSS6.4AI score0.0509EPSS
SaveExploits2References3
Nuclei
Nuclei
added 10 hours ago60 views

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php id: CVE-2021-4449 info: name: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload author: 0xnemian severity: critical description: | ZoomSounds plugin for WordPress contains a file upload vulnerability in...

9.8CVSS7.7AI score0.05439EPSS
SaveExploits2References5
Nuclei
Nuclei
added 10 hours ago26 views

MikoPBX - Unrestricted File Upload

MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php. id: CVE-2025-52207 info: name: MikoPBX - Unrestricted File Upload author: darses severity: critical description: |...

9.9CVSS5.5AI score0.01499EPSS
SaveExploits0References1
Rows per page
Query Builder