34005 matches found
CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71251
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71251
CVE-2026-71251 (Akaunting) : The shared download route app/Http/Controllers/Common/Uploads.php::download() allowed an authenticated portal customer to fetch any Media by ID without verifying ownership. This constitutes a cross-company IDOR: a user could download another company’s uploaded files b...
WordPress Multi Uploader for Gravity Forms plugin <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability discovered by Riski Gana Prasetya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.8...
CVE-2026-6147
The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...
CVE-2026-5581
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...
CVE-2026-70374
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...
EUVD-2026-53180
The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...
CVE-2026-5581 Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...
EUVD-2026-53170
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...
CVE-2026-5581
The CVE-2026-5581 entry concerns the WordPress plugin Multi Uploader for Gravity Forms . It is vulnerable in all versions up to and including 1.1.8 due to missing capability checks in the function plupload_ajax_delete_file() , which is registered via wp_ajax_nopriv_gfmu_delete_file . The CSRF-pro...
CVE-2026-15941
creationtimestamp| type| source ---|---|--- 2026-08-05 06:30:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4rjksjeib4sit 2026-08-06 01:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mseujallv62n 2026-08-06 05:15:46+00:00| seen|...
EUVD-2026-53097
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...
CVE-2026-70374 HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...
CVE-2026-70374 HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...
CVE-2026-70374 HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...
CVE-2026-70374
HashBrown CMS prior to 1.4.6 is affected by an OS command injection in the media thumbnail generation flow. Media.generateThumbnail() builds a temporary path like 'thumbnail' + extname(filename) and passes it unescaped into a shell command executed by AppService.exec() (example: 'convert ' + temp...
CVE-2026-18103
A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...