CVE-2026-67206

Wolf CMS 0.8.3.1 contains an authenticated RCE in FileManagerController due to missing file extension validation in create_file() and save(). Attackers with the file_manager_mkfile capability can write arbitrary PHP into the web-accessible FILES_DIR and trigger execution via HTTP. CVSS data indic...

CVE-2026-67206 Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

CVE-2025-57148

phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation...

CVE-2025-57148

phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation...

PT-2025-35779

Name of the Vulnerable Software and Affected Versions: phpgurukul Online Shopping Portal version 2.0 Description: phpgurukul Online Shopping Portal version 2.0 contains an arbitrary file upload issue in the /admin/insert-product.php component. This is due to missing extension validation, allowing...

CVE-2025-57148

CVE-2025-57148 affects phpgurukul Online Shopping Portal 2.0. The vulnerability is an Arbitrary File Upload in /admin/insert-product.php caused by lack of extension validation. Reported details across multiple sources confirm the affected software and the specific component, with CVSSv3.1 vector ...