74 matches found
CVE-2026-6611 liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key
A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File Upload Endpoint. Performing a manipulation of the argument SECRETKEY results in use of hard-coded cryptographic key . Remote exploitation o...
sonic-server 安全漏洞
Sonic-server is a mobile device remote debugging and automated testing platform open source by Sonic Cloud Org. Versions of sonic-server 2.0.0 and earlier contain security vulnerabilities. These vulnerabilities stem from improper handling of parameter types in the Upload function of the File Uplo...
PT-2026-33718
A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File Upload Endpoint. Performing a manipulation of the argument SECRET KEY results in use of hard-coded cryptographic key . Remote exploitation ...
CVE-2026-6572
Collabora KodExplorer up to 4.52 is affected by a vulnerability in the fileUpload Endpoint, specifically in /app/controller/share.class.php where manipulation of the fileUpload argument leads to improper authorization. Remote exploitation is possible with high attack complexity, and exploitation ...
CVE-2026-6572 Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization
A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper authorization. Remot...
CVE-2026-35608
CVE-2026-35608 concerns QuickDrop, a file sharing app. A vulnerability exists in the file preview endpoint prior to 1.5.3 where SVGs uploaded via /api/file/upload-chunk can contain JavaScript payloads that execute when users view the file preview. This is a stored XSS in the preview UI context, p...
CVE-2026-5615
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possibl...
CVE-2026-5615
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possibl...
CVE-2026-5615 givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possibl...
CVE-2026-5615 givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possibl...
CVE-2026-5615
The CVE-2026-5615 issue affects givanz Vvvebjs up to 2.0.5, specifically the File Upload Endpoint’s file upload.php. An manipulation of the uploadAllowExtensions argument enables cross-site scripting, with remote exploitation possible and a public exploit available. A patch is provided as 8cac22c...
CVE-2026-5615
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possibl...
CVE-2026-5615 givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possibl...
PT-2026-30559
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possibl...
CVE-2026-0558 Unauthenticated File Upload in parisneo/lollms
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the Dependsgetcurrentactiveus...
CVE-2026-0558 Unauthenticated File Upload in parisneo/lollms
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the Dependsgetcurrentactiveus...
CVE-2026-5026 Langflow - Stored XSS via Malicious SVG Upload
The '/api/v1/files/images/flowid/filename' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leadi...
CVE-2026-4221 Tiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted upload
A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the component Endpoint. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit has...
SUSE CVE-2026-25242
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any remote user can upload arbitrary files to the server via /releases/attachments and...
GetSimple CMS 代码问题漏洞
GetSimple CMS is an open-source content management system developed by GetSimple CMS. There are code issues and vulnerabilities in GetSimple CMS; these vulnerabilities stem from the lack of cross-site request forgery protection in the file upload endpoint, which may lead to arbitrary file uploads...