EUVD-2026-85419

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-96513 Neethuharii CafeManagement AddProductCode.php unrestricted upload

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

DRUPAL-CONTRIB-2026-172

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...

DRUPAL-CONTRIB-2026-169

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configuration...

CVE-2026-5695

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

CVE-2026-5695 Multiple vulnerabilities in the Microweber administration panel

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

EUVD-2026-85219

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

CVE-2026-5695

The Microweber administration panel is vulnerable to an arbitrary file upload vulnerability caused by a lack of proper validation in upload forms. This flaw allows authenticated users to upload files to the server without restrictions. An attacker can exploit this to execute malicious code remote...

CVE-2026-5695 Multiple vulnerabilities in the Microweber administration panel

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

CVE-2026-75799 YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

CVE-2026-75799

The YAHMAN Add-ons WordPress plugin, in versions before 0.9.31 , is vulnerable to an unauthenticated arbitrary file upload due to a lack of validation for remote files cached in a publicly accessible directory. An unauthenticated attacker can exploit this to write arbitrary PHP files on the serve...

CVE-2026-75799 YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

Fortinet FortiNAC - Arbitrary File Write

Fortinet FortiNAC is susceptible to arbitrary file write. An external control of the file name or path can allow an attacker to execute unauthorized code or commands via specifically crafted HTTP request, thus making it possible to obtain sensitive information, modify data, and/or execute...

EUVD-2026-84987

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

EUVD-2026-84978

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

CVE-2026-95830

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

PT-2026-97400

Name of the Vulnerable Software and Affected Versions Neethuharii CafeManagement affected versions not specified Description A security flaw allows remote attackers to perform unrestricted file uploads. This occurs due to improper processing of the image argument within the 'AddProductCode.php'...

PT-2026-97267

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Authenticated users can upload files to the server without restrictions due to a lack of proper validation in upload forms. This flaw allows for arbitrary file...

PT-2026-97613

Name of the Vulnerable Software and Affected Versions weiqingwen spring-boot-forum versions up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f Description A path traversal issue exists in the Avatar Upload component. A remote attacker can exploit this by manipulating the Username argument within the...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...