CVE-2026-42322 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

CVE-2026-42322

The Piwigo open source photo gallery application is vulnerable to Arbitrary Command Execution in versions prior to 16.4.0 . The root cause is located in admin/themes_standard_pages.php, where the application validates uploaded logo content by MIME type but improperly reuses the attacker-controlle...

Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

Blueimp jQuery-File-Upload v9.22.0 contains an unauthenticated arbitrary file upload caused by insufficient validation in the upload component, letting remote attackers upload malicious files, exploit requires no authentication. id: CVE-2018-9206 info: name: Blueimp jQuery-File-Upload v9.22.0 -...

Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. id: CVE-2024-7399 info: name: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution author:...

CVE-2026-42322: Unrestricted Upload of File with Dangerous Type

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

CVE-2026-97322

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97323

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-13249

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

EUVD-2026-86405

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-97323 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-97323

A path traversal vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (up to version 2026.08). The flaw resides in the getOriginalFilename function within the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.ja...

CVE-2026-97323 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97322

A cross-site scripting (XSS) vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (versions up to 2026.08). The flaw affects an unspecified function within the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileControll...

EUVD-2026-86398

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-13249 Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

CVE-2026-13249

The Honeywell PD45 Industrial Printer (version F10.19.010040 ) is vulnerable to an unauthenticated Remote Code Execution (RCE) via Arbitrary File Upload in its web management interface. This flaw allows an attacker to upload and execute malicious files or commands without any authentication. To r...

EUVD-2026-86350

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

CVE-2026-13249 Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...