CVE-2026-85197

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

WordPress LearnDash LMS plugin <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin LearnDash LMS versions = 5.1.5...

Fortra GoAnywhere MFT Auth Bypass RCE (CVE-2024-0204)

Exploits CVE-2024-0204 to create an administrator via the InitialAccountSetup wizard path traversal, upload a JSP payload through the FileManager, and execute a reverse CMD command. GoAnywhere MFT 6.0.1 through 7.4.0. !/usr/bin/env python3 -- coding: utf-8 -- """Fortra GoAnywhere MFT auth bypass ...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

WordPress File Manager RCE (CVE-2020-25213)

Exploits CVE-2020-25213 unauthenticated elFinder upload in wp-file-manager to drop a PHP shell, then runs commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress File Manager elFinder upload RCE CVE-2020-25213 — execute session.""" from futur...

CVE-2026-84066

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions before 8.9 ) is vulnerable to an arbitrary post metadata write. The root cause is a failure to verify that a requesting user owns the post before writing uploaded file references to its metadata. ...

PT-2026-86238

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

CVE-2026-71620

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

CVE-2026-78839

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-75169: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

EUVD-2026-71772

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

Linux Distros Unpatched Vulnerability : CVE-2026-76174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based o...

CVE-2026-71620

A File Upload vulnerability exists in Zhao-github ApiAdmin v.5.0.1 , allowing a remote attacker to execute arbitrary code . The root cause is the ability to upload a crafted .php file to the system. The provided documents do not specify a remediation or a direct link to a functional exploit.

EUVD-2026-71712

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

EUVD-2026-71444

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-71620: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

CVE-2026-50894

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

EUVD-2026-71711

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

PT-2026-86233

Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem affected versions not specified Description A Zip Slip issue exists in the file upload and archive processing functionality. This allows an attacker to extract files outside the intended destinati...