56567 matches found
CVE-2026-75339: Missing Authorization
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...
The vulnerability of the AdminerFileUpload plugin in the plugins/file-upload.php module of the Adminer database management system allows a hacker to execute arbitrary code.
The vulnerability of the AdminerFileUpload plugin in the plugins/file-upload.php software for managing databases in Adminer relates to the unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
Exploit for CVE-2026-32475
CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitra...
CVE-2026-81931
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...
EUVD-2026-67225
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...
CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...
CVE-2026-81931
Roskus Prospero Flow CRM before 5.16.0 is affected by an unrestricted file upload in the product photo feature. The validation logic checks only magic bytes and blocks a fixed list of PHP extensions , but ProductSaveController::save() stores the file using the client-supplied extension in the pub...
CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...
CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...
EUVD-2026-64745
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...
CVE-2026-78251
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...
CVE-2023-4861-PoC
CVE-2023-4861 PoC Questo repository contiene una prova di concetto in Python per CVE-2023-4861 , un problema di esecuzione remota di codice autenticato nel plugin WordPress File Manager Pro - Filester. Riepilogo della vulnerabilità CVE: CVE-2023-4861 Prodotto: File Manager Pro - Filester filester...
CVE-2026-79653
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The...
EUVD-2026-67130
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability
Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...
CVE-2026-78274
Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78274 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability
Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78274 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability
Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...