46397 matches found
Studio Fabryka DobryCMS 代码问题漏洞
Studio Fabryka DobryCMS is a content management system developed by Studio Fabryka. Versions of Studio Fabryka DobryCMS prior to version 5.0 had code vulnerabilities. These vulnerabilities stemmed from defects in the file upload functionality, which could lead to remote code execution...
📄 WordPress File Upload 4.24.11 Path Traversal / Remote Code Execution
A critical unauthenticated remote code execution vulnerability exists in the WordPress File Upload plugin versions 4.24.11 and earlier. The vulnerability allows attackers to execute arbitrary operating system commands through path traversal and improper input validation in the wfufiledownloader.p...
📄 WordPress Elementor 3.18.1 Shell Upload
Proof of concept exploit for WordPress Elementor plugin version 3.18.1 that demonstrates a remote shell upload vulnerability. ============================================================================================================================================= | Title : WordPress Elementor...
📄 WordPress Flex QR Code Generator 1.2.5 Shell Upload
Proof of concept exploit for a remote shell upload vulnerability in WordPress Flex QR Code Generator plugin version 1.2.5. ============================================================================================================================================= | Title : WordPress Flex QR Code...
📄 WordPress External Post Editor 1.2.3 Scanner
This PHP forensic scanner is designed to assess WordPress sites for the External Post Editor plugin vulnerability in version 1.2.3 that allows unauthenticated file upload potentially leading to remote code execution...
Multer vulnerable to Denial of Service via resource exhaustion
Impact A vulnerability in Multer versions 2.1.0 allows an attacker to trigger a Denial of Service DoS by dropping connection during file upload, potentially causing resource exhaustion. Patches Users should upgrade to 2.1.0 Workarounds None...
Missing Release of Resource after Effective Lifetime
Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the makeMiddleware function, when dropping a connection during file upload. An attacker can cause resource exhaustion. Details Denial of Service DoS describes a family of attacks,...
Missing Release of Resource after Effective Lifetime
Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the makeMiddleware function, when dropping a connection during file upload. An attacker can cause resource exhaustion. Details Denial of Service DoS describes a family of attacks,...
CVE-2025-69437
PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can...
CVE-2026-28270
Summary: CVE-2026-28270 affects Kiteworks Core. Before version 9.2.0, a configuration flaw allowed uploading of arbitrary files without proper validation, enabling malicious administrators to upload unauthorized file types. The issue is addressed in version 9.2.0, which contains a patch. Affected...
CVE-2026-28270 Kiteworks Core has an Unrestricted Upload of File with Dangerous Type
Kiteworks is a private data network PDN. Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch fo...
CVE-2026-28270 Kiteworks Core has an Unrestricted Upload of File with Dangerous Type
Kiteworks is a private data network PDN. Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch fo...
EUVD-2026-9065
Kiteworks is a private data network PDN. Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch fo...
CVE-2026-1565
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WPUFAdminSettings::checkfiletypeandext' function and in the...
CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion
Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service DoS by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to...
CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion
Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service DoS by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to...
CVE-2026-2359
Multer (Node.js middleware for multipart/form-data) is affected by a DoS vulnerability in versions prior to 2.1.0. The issue arises when a sender drops the connection during file upload, potentially exhausting resources. The advisory recommends upgrading to version 2.1.0, with no published workar...
CVE-2026-24350 Stored XSS in PluXml CMS
PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which will be executed when a victim clicks the link associated with the uploaded image. In version 5.9.0-rc7 clicking the link associated with...
WordPress User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload vulnerability
Authenticated Author+ Arbitrary File Upload vulnerability discovered by Williwollo CybrX in WordPress Plugin WP User Frontend versions = 4.2.8...