1307 matches found
CVE-2026-14282: Unrestricted Upload of File with Dangerous Type
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...
UBUNTU-CVE-2026-64131
In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This condition is tested in migratedevicepages and makedeviceexclusive...
CVE-2026-12684
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
CVE-2026-12684
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
CVE-2026-12684
The Customer Reviews for WooCommerce WordPress plugin versions prior to 5.113.0 is vulnerable to unauthenticated media uploads. The flaw exists because one of its media upload AJAX actions fails to perform authentication, capability, or nonce checks when the review media attachment feature is act...
CVE-2026-12684 Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
EUVD-2026-44877
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
CVE-2026-12684: Unrestricted Upload of File with Dangerous Type
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...
CVE-2026-11579
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
CVE-2026-11579
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin in versions before 2.4.17 contains an unauthenticated media upload vulnerability. The software fails to verify that a file upload is associated with an existing form configured with a file-upload field, allowing unauthenticate...
CVE-2026-11579 Kali Forms < 2.4.17 - Unauthenticated Media Upload
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
CVE-2026-11579
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
EUVD-2026-44592
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
CVE-2026-11579 Kali Forms < 2.4.17 - Unauthenticated Media Upload
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
CVE-2026-61371
Microsoft AVML versions prior to 0.17.0 are vulnerable to a truncation-before-validation flaw on Unix systems. The software can follow a symlink when opening a destination output path, enabling an attacker to trigger a destructive truncation or overwrite of the symlink target. This occurs at open...
PT-2026-58879
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
CVE-2026-11579: Unrestricted Upload of File with Dangerous Type
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
Arbitrary File Upload
Overview area17/twill is an open-source CMS toolkit for Laravel that helps developers rapidly create a custom admin console that is intuitive, powerful, and flexible. Affected versions of this package are vulnerable to Arbitrary File Upload via the storeFile function in the Media Library Insert...
CVE-2026-15518
A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to...