CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-32559

UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...

CVE-2026-78337

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Plugin UltimateAI versions = 3.1.0...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

EUVD-2026-64825

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78245

itsourcecode Online Pharmacy System 1.0 is affected by an unrestricted file upload vulnerability in the User Registration component. The flaw resides in the move_uploaded_file function within all_users/register.php, where manipulation of the photo argument allows a remote, unauthenticated attacke...

CVE-2026-78245 itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function moveuploadedfile of the file allusers/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. T...

CVE-2026-78245 itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function moveuploadedfile of the file allusers/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. T...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability

Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

Exploit for OS Command Injection in Tenable Security_Center

C...

CVE-2026-78202

itsourcecode Payroll System 1.0 is affected by an unrestricted file upload vulnerability in the save_settings function of the file admin_class.php . The root cause is improper handling of the img argument, which allows a remote attacker to upload arbitrary files without authentication. The impact...

CVE-2026-19852

NewSiteServer NSS developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting...

EUVD-2026-64707

NewSiteServer NSS developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting...

CVE-2026-19852 CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload

NewSiteServer NSS developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting...

CVE-2026-19852

NewSiteServer (NSS) developed by CyberTutor is affected by an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, achieving effects similar to cross-site scripting (XSS) . The CVSS 3.1 base score is 6.1 (MEDIUM) , with ...

CVE-2026-32559: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

PT-2026-81049

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

PT-2026-79833

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...