PT-2026-3030

Name of the Vulnerable Software and Affected Versions phpKF CMS version 3.00 Beta y6 Description The software contains an unauthenticated file upload issue that enables remote attackers to execute arbitrary code. This is achieved by bypassing file extension checks, allowing attackers to upload a...

CVE-2025-67077

File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action...

PT-2026-3156

Name of the Vulnerable Software and Affected Versions Phpwcms version 1.9.30 Description The software contains a file upload issue that permits authenticated attackers to upload malicious SVG files containing JavaScript. Attackers can leverage the multiple file upload functionality to upload...

EUVD-2026-2759

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions...

ProjeQtOr code-related vulnerabilities

ProjeQtOr is a project management software developed by the French company ProjeQtOr. Version 9.1.4 of ProjeQtOr contains a code vulnerability; this vulnerability stems from insufficient validation of the file upload function, which may allow arbitrary code to be executed...

CVE-2025-67079

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions...

CVE-2025-67084

The CVE-2025-67084 entry concerns InvoicePlane up to version 1.6.3, where an authenticated file-upload flaw allows uploading arbitrary PHP files into attachments, enabling remote code execution (RCE). Affected component is the file upload handling in attachments; the root cause is not explicitly ...

InvoicePlane security vulnerabilities

InvoicePlane is an open-source application developed by InvoicePlane. It provides a self-hosted open-source tool for managing your quotes, invoices, customers, and payments. InvoicePlane versions 1.6.3 and earlier contain security vulnerabilities, which stem from defects in the file upload...

EUVD-2026-2761

File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action...

phpKF CMS security vulnerability

phpKF CMS is a content management system developed by the Turkish company phpKF. The phpKF CMS 3.00 Beta y6 version contains a security vulnerability. This vulnerability stems from an unverified file upload function, which may bypass file extension checks, allowing remote code execution...

CVE-2025-67077

File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action...

CVE-2025-67079

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions...

CVE-2025-67084

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution RCE...

Omnispace Agora Project security vulnerabilities

Omnispace Agora Project is a satellite IoT verification project developed by the American company Omnispace. Versions of Omnispace Agora Project prior to version 25.10 contained security vulnerabilities. These vulnerabilities stemmed from defects in the file upload function, which could allow...

PT-2026-3024

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 25.10 Description A file upload issue exists in Omnispace Agora Project. Attackers can potentially execute code by uploading a specially crafted PDF file. This is possible through the MSL engine of the...

CVE-2025-67079

CVE-2025-67079 describes a file upload vulnerability in Omnispace Agora Project prior to 25.10. The issue allows code execution via the MSL engine of the Imagick library when a crafted PDF is uploaded through the file upload and thumbnail functions. The underlying cause is misuse in handling craf...

PT-2026-3028

Name of the Vulnerable Software and Affected Versions InvoicePlane versions through 1.6.3 Description A file upload issue exists in InvoicePlane that allows authenticated attackers to upload arbitrary PHP files into attachments. These uploaded files can then be executed remotely, potentially...

EUVD-2026-2785

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution RCE...

CVE-2022-50907

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution...

CVE-2025-37175

Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary comman...