46786 matches found
CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...
EUVD-2026-54411
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...
CVE-2026-66492
Phoca Commander (Joomla extension by phoca.cz) versions 1.0.0-6.1.3 expose a path traversal vulnerability in the file upload action, caused by improper limitation/validation of upload paths. This results in a path traversal flaw within the module. The connected documents confirm the affected prod...
CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...
EUVD-2026-54309
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...
EUVD-2026-54209
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
CVE-2026-67688
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...
CVE-2026-19065
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...
CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
CVE-2026-3418
The CVE-2026-3418 entry concerns the System REST API in multiple WSO2 products that allows arbitrary file uploads due to insufficient validation of file type/destination. The vulnerability enables an authenticated publisher (admin with publisher privileges) to upload files to server-accessible lo...
CVE-2026-66665
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...
EUVD-2026-53891
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66665
CVE-2026-66665 affects the WordPress Type Hub plugin (versions
CVE-2026-66665
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66447 WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...