47745 matches found
EUVD-2026-37667
Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...
EUVD-2026-37650
Subscriber Arbitrary File Upload in Restaurt = 1.0.4 versions...
EUVD-2025-210228
Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...
EUVD-2024-55628
Subscriber Arbitrary File Upload in Grip = 1.0.9 versions...
EUVD-2025-210224
Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...
02url-querystring-http (>=1.0.1, <=1.0.4), 1-0-5-hai-aage-dekhte-hein-kya-aat-hai (>=1.0.5, <=1.0.6) +12635 more potentially affected by CVE-2026-5079 via multer (>=1.0.3, <=2.1.1)
multer NPM version =1.0.3, =1.0.1, =1.0.5, =2.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.3 - 6e-alpha-backend-admin 1.0.0 and more Source cves: CVE-2026-5079 Source advisory: OSV:GHSA-72GW-MP4G-V24J...
4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1550 more potentially affected by CVE-2026-5038 via multer (>=2.0.0, <=2.1.1)
multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-5038 Source advisory: OSV:GHSA-3P4H-7M6X-2HCM...
Exploit for CVE-2026-48907
CVE-2026-48907 CVE-2026-48907 is a critical improper acc...
Cross-site Scripting (XSS)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Markdown file preview process when rendering Mermaid blocks with a permissive security configuration. An attacker can execute arbitrary JavaScript in the context of the victim'...
CVE-2026-52705
Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...
CVE-2026-48616
Rocket.Chat versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rcroomtype=l with rcrid+rctoken, but the authorization path does not verify...
CVE-2026-40747
Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...
CVE-2026-40749
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
CVE-2026-40746
Subscriber Arbitrary File Upload in Restaurant Zone = 0.7.8 versions...
CVE-2026-40748
Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...
CVE-2026-39598
Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2...
CVE-2026-39589
Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...
CVE-2026-27041
Contributor Arbitrary File Upload in Unlimited Elements for Elementor Premium = 2.0.6 versions...