EUVD-2026-54441

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in ...

CVE-2026-66492

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

CVE-2026-66492

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

EUVD-2026-54411

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

CVE-2026-66492

Phoca Commander (Joomla extension by phoca.cz) versions 1.0.0-6.1.3 expose a path traversal vulnerability in the file upload action, caused by improper limitation/validation of upload paths. This results in a path traversal flaw within the module. The connected documents confirm the affected prod...

CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

EUVD-2026-54309

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

EUVD-2026-54209

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

PT-2026-68906

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application contains file upload functionalities susceptible to a buffer overflow. An unauthenticated attacker can cause a server crash and a subsequent denial of service by...

PT-2026-68886

Name of the Vulnerable Software and Affected Versions Phoca Commander versions 1.0.0 through 6.1.3 Description Improper limitation of paths in the file upload action allows for a path traversal, which occurs when an application uses user-controllable input to construct a pathname that is used in ...

CVE-2026-66492: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

PT-2026-69048

Name of the Vulnerable Software and Affected Versions Weaver Fanwei E-cology 9.0 versions prior to 10.52 Description A file upload issue allows a remote, unauthenticated attacker to upload arbitrary files, such as JSP webshells. This is achieved by submitting a multipart/form-data POST request to...

CVE-2022-4995: Unrestricted Upload of File with Dangerous Type

Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...

CVE-2026-67688

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

CVE-2026-19065

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...

GHSA-QHR7-V3XP-VW9M Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the assets or files fields in frontend forms. An attacker can upload disallowed file types by submitting specially crafted files through these fields, potentially bypassing intended administrative restrictions...

CVE-2026-19065 SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...