PT-2026-107851

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10 Description An unauthenticated arbitrary file upload issue exists due to insufficient validation of the attacker-controlled URL field within the temporaryFileUploads parameter during form submission. An...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher 인증되지 않은 파일 업로드 RCE isimage와 extractfileextension의 불일치 → PHP 폴리글롯 업로드 개요 CVE-2026-13001 은 Podlove Podcast Publisher WordPress 플러그인 ≤ 4.5.1 버전에서 발생하는 인증되지 않은 임의 파일 업로드 취약점으로, 심각도CVSS 9.8가 치명적 입니다. 이 취약점은 두 내부 함수가 파일 확장자를 다르게 파싱하는 불일치를 악용합니다: isimage는...

EUVD-2026-89995

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...

PT-2026-103328

Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla CCK versions prior to 8.3.16 Description An unauthenticated remote code execution issue exists in the site/uploader.php endpoint, which is accessible via the getContent task. The system fails to perform authentication or Access...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...

Exploit for CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450

BookStack before version 26.05.4 is affected by a remote code execution vulnerability in the portable ZIP import functionality. A user with Import Content and Create Books permissions can upload a PHP polyglot file disguised as a book cover. The attacker bypasses image extension validation by emb...

EUVD-2026-68105

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

PT-2026-83429

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...

CVE-2026-82450: Unrestricted Upload of File with Dangerous Type

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-18438

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

PT-2026-72881

Name of the Vulnerable Software and Affected Versions Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2 Description Authenticated attackers with contributor-level access and above can achieve remote code execution via the fetc...

Podlove Podcast Publisher 4.5.1 Shell Upload

A proof of concept exploit for an unauthenticated arbitrary file upload vulnerability leading to remote code execution in Podlove Podcast Publisher version 4.5.1. The vulnerability uses inconsistent parsing of an attacker-controlled source URL, allowing a GIF/PHP polyglot to pass file-type...

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Summary rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the en...

CVE-2026-53599 Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...