CVE-2026-110185

The Bit Flows: AI Agent Automation & Integrations plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.31.0 . The vulnerability exists in the 'image' parameter (used by the ImageHelper node's mix tag). An unauthenticated attacker can include and e...

CVE-2026-110185 Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

C97net qEngine CMS arbitrary file upload vulnerability

C97net qEngine CMS versions 6.0.0 and earlier, Kemana Directory versions 1.5.6 and earlier, and Cart Engine versions 3.0.0 and earlier contain an arbitrary file upload vulnerability. This vulnerability arises from unrestricted file uploads in the image management field; users with edit permission...

CVE-2026-57448: mrblomblo blombooru: Blombooru is a self-hosted personal booru for organizing and tagging private image collections

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only GET /proxy-image endpoint, exposed as /api/booru-import/proxy-image, accepts a url query parameter and fetches it server-side without meaningful destination...

CVE-2026-118537: n/a a2ui: A vulnerability was found in a2ui up to 0.10.4

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...

A2UI input validation error vulnerability

Versions A2UI 0.10.4 and earlier contain an input validation error vulnerability. This vulnerability stems from improper input handling of the ‘url’ parameter in the file src/v09/basiccatalog/components/Image.js within the Image Player/Video Player/Audio Player components. Attackers can exploit...

PT-2026-128221

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is...

WordPress Bit Flows code injection vulnerability

WordPress Bit Flows versions 1.31.0 and earlier contain a code injection vulnerability. This vulnerability stems from improper handling of local file inclusion for the image parameter the body field referenced by the mix tag in the ImageHelper node. It may allow unauthenticated attackers to inclu...

Image Gallery Block – Showcase Photos in Stunning Responsive Grids < 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Image Gallery Block – Showcase Photos in Stunning Responsive Grids plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1. This is due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-127801

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload image function. This is due to insufficient file type validation in upload image due to a weak Content-Ty...

PT-2026-127799

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page image or cat image parameters to the web-accessible /public/image...

Enhanced Image Forensics through Partial C2PA-Based Provenance Information

Cryptographically verifiable C2PA-based Content Credentials CCs can be attached to freshly acquired or generated digital images but also to already existing ones with no previous provenance information, for instance after processing through trusted C2PA-enabled software tools. The latter case lea...

YOOtheme Pro 5.0.52 Image Handler Shell Upload

YOOtheme Pro versions 5.0.0 through 5.0.52 contain an unauthenticated image-handler signature reuse and path traversal issue that can write a JPEG/PHP polyglot webshell and execute commands. https://packetstorm.news/download/238039...

CVE-2014-125138: C97net: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted…

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the pageimage or catimage parameters to the web-accessible /public/image...

Blomblo blombooru server-side request forgery vulnerability

Versions prior to Blomblo Blombooru 1.40.0 contain a server-side request forgery vulnerability. This flaw arises because the GET /proxy-image endpoint exposed at /api/booru-import/proxy-image is intended solely for administrators. It fails to validate the target address within URL query parameter...

PT-2026-129210

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only GET /proxy-image endpoint, exposed as /api/booru-import/proxy-image, accepts a url query parameter and fetches it server-side without meaningful destination...

Progress Software Telerik Document Processing Libraries input validation error vulnerability

Versions of Progress Software Telerik Document Processing Libraries prior to 2026.3.1027 contain an input validation error vulnerability. This vulnerability stems from XML external entity references in SVG image processing, potentially allowing unauthenticated attackers to read local server files...

CVE-2026-118039: Progress Software Telerik Document Processing Libraries: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference…

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is...

PT-2026-129207

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0 9/basic catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack ma...

stegpy

stegpy A program for encoding information in image, audio, and video files through steganography. Any type of data can be encoded, from raw strings to files, as shown below: On the left, a house with a steganographically hidden image. On the right, the extracted hidden image of a cat. It is...