CVE-2026-14553

The zportals WordPress plugin (versions before 6.3.4 ) contains an arbitrary file upload vulnerability due to improper validation of uploaded files. The plugin incorrectly trusts client-supplied content types and preserves original file extensions. This allows any authenticated user with Subscrib...

Malicious code in streak-test-mathcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1 Package main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via childprocess.spawn on any import of the package. The bundled ELF...

PT-2026-68573

Name of the Vulnerable Software and Affected Versions Iptanus File Upload versions prior to 5.1.8 Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additiona...

CVE-2026-18927: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

PT-2026-68173

Name of the Vulnerable Software and Affected Versions wiseCampaign – WooCommerce Conversions Made Easy versions prior to 1.1.17 Description The plugin is susceptible to unauthorized data disclosure and modification because all REST API endpoints are registered with permission callback = ' return...

CVE-2026-6147: Unrestricted Upload of File with Dangerous Type

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-54416: Unrestricted Upload of File with Dangerous Type

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

PT-2026-68119

Name of the Vulnerable Software and Affected Versions wp-downloadmanager versions 1.68.11 through 1.69.0 wp-downloadmanager versions 6.9.4 through 6.9.4 Description An admin-privileged user with manage downloads capabilities can upload arbitrary files through the 'download-add.php' endpoint. The...

CVE-2026-60009: Cross-Site Request Forgery (CSRF)

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

PT-2026-67969

Name of the Vulnerable Software and Affected Versions zportals WordPress plugin versions prior to 6.3.4 Description The plugin fails to properly validate uploaded files by trusting the client-supplied content type and preserving the original file extension. This allows any authenticated user with...

PT-2026-68095

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.73.2 Description The @theia/filesystem backend binds the 'POST /file-upload' endpoint in every filesystem-enabled deployment. The handler processes an absolute path provided by an attacker via the multipart ur...

CVE-2026-18933: Unrestricted Upload of File with Dangerous Type

The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...

PT-2026-68028

Name of the Vulnerable Software and Affected Versions LightSync Pro versions prior to 2.1.7 Description The LightSync Pro plugin for WordPress allows authenticated attackers with Author-level access or higher to upload arbitrary files to the server. This issue occurs because the rest replace medi...

VulnCheck KEV: CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

EUVD-2026-39021

Ghost: File Upload Content-Type Spoofing...

GHSA-944X-PM95-3JPR Ghost: File Upload Content-Type Spoofing

Impact Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the...

NPM: Ghost: File Upload Content-Type Spoofing

NPM: Ghost: File Upload Content-Type Spoofing vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

CLSA-2026-1777941823 TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)

TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.2.1-tuxcare.2...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input to the TypeORM DataSource class, which allows arbitrary options to be set. An attacker can achieve arbitrary code execution on the server by uploading...

WordPress Ultimate Product Catalog plugin <= 3.8.6 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Ultimate Product Catalogue versions = 3.8.6...