CVE-2026-29909

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without any credentials...

PT-2026-29058

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without any credentials...

CVE-2026-29909

CVE-2026-29909 affects MRCMS v3.1.2. The /admin/file/list.do endpoint in the file management module is unauthenticated and lacks input validation, enabling remote directory enumeration without credentials. The vulnerability is consistently described across NVD, Red Hat, ENISA EUVD, CVE List, and ...

CVE-2026-29909

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without any credentials...

MRCMS 安全漏洞

MRCMS is a content management system developed by Marker individuals. MRCMS V3.1.2 has a security vulnerability that stems from the lack of authentication and input validation in the file management module, which may lead to unvalidated directory enumeration...

EUVD-2026-11367

StudioCMS S3 Storage Manager Authorization Bypass via Missing await on Async Auth Check...

PT-2026-24818

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...

CVE-2026-21628

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

EUVD-2026-9816

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

Astroid Template Framework 代码问题漏洞

Astroid Template Framework is an open-source Joomla template development framework developed by Astroid. The Astroid Template Framework has code vulnerabilities, which stem from inadequate protection of the file management function. This could allow unverified users to upload dangerous data types...

PT-2026-23436

Name of the Vulnerable Software and Affected Versions Astroid Framework versions 2.0.0 through 3.3.10 Description An improperly secured file management feature permits the upload of dangerous data types by unauthenticated users, potentially resulting in remote code execution. The vulnerability...

CVE-2025-15549

FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via the File Management module. Attackers can upload malicious SVG files that execute JavaScript in the browser of any user accessing the...

Cross-site Scripting (XSS)

Overview FluentCMS.Web.Plugins.Admin is a plugin for an ASP.NET Core Blazor Content Management System CMS Affected versions of this package are vulnerable to Cross-site Scripting XSS in the File Management module. An admin user can upload malicious SVG files to execute scripts in the browser of...

CVE-2025-15549

FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via the File Management module. Attackers can upload malicious SVG files that execute JavaScript in the browser of any user accessing the...

CVE-2025-15549

FluentCMS 2026 contains a stored cross-site scripting (XSS) vulnerability in the File Management module. An authenticated administrator can upload SVG files with embedded JavaScript, which is then executed in the browser of any user who accesses the uploaded file URL. Affected component: FluentCM...