47670 matches found
CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...
CVE-2026-67361
J2Store (a Joomla e-commerce extension) is vulnerable to unauthenticated file upload in versions 1.0.0–3.3.20, 4.0.0–4.0.20, and 4.1.0–4.1.5. The file upload endpoint accepted POST requests without authentication or CSRF protection. Additionally, the installer manifest omitted the upload and invo...
CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...
CVE-2024-50510
CVE-2024-50510 AR For Woocommerce = 6.2 - Caricamento arbitrario di file senza autenticazione Descrizione Il plugin AR for WooCommerce per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancata validazione del tipo di file in tutte le versioni fino alla 6.2 inclusa. Ciò...
CVE-2026-55241
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...
CVE-2026-55241 Checkmate: Pre-auth Denial of Service via File Upload on Registration
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...
CVE-2026-55241 Checkmate: Pre-auth Denial of Service via File Upload on Registration
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...
CVE-2026-77681
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...
CVE-2026-77681 CodeAstro Online Job Portal update-profile.php unrestricted upload
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...
CVE-2026-77681
CodeAstro Online Job Portal 1.0 is affected by an unrestricted file upload vulnerability in the file /users/update-profile.php. Manipulation of the Name argument allows a remote, authenticated attacker (low privileges) to upload arbitrary files, leading to low impact on confidentiality, integrity...
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload vulnerability
Unauthenticated Stored XSS via SVG File Upload vulnerability discovered by Samdup Choephel in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...
WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...
CVE-2026-18781
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...
EUVD-2026-63821
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...
CVE-2026-18781 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...
CVE-2026-18781
CVE-2026-18781 affects the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin in versions before 1.3.9.9 . The root cause is a control character filename bypass : the plugin strips characters from uploaded filenames but does not re-validate the resulting name, allowing an unau...
CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...
CVE-2024-9047
POC - Plugin WordPress File Upload, nel file wfufiledownloader.php prima della versione = 4.24.11 - CVE-2024-9047 Panoramica Il plugin WordPress File Upload è vulnerabile a causa di una convalida degli input impropria nel file wfufiledownloader.php, che interessa le versioni = 4.24.11. Questa...
CVE-2024-56064
CVE-2024-56064 WP SuperBackup = 2.3.3 - Caricamento Arbitrario di File Non Autenticato Descrizione Il plugin Super Backup & Clone - Migrate for WordPress per WordPress è vulnerabile al caricamento arbitrario di file a causa della mancata validazione del tipo di file in tutte le versioni fino alla...