CVE-2026-61424

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61900

Affected software: Joomla extension DJ-Extensions JDownloads (DJ-jDownloads). Vulnerability: Unauthenticated file upload leading to full RCE. Root cause / details: Reported as unauthenticated arbitrary file upload in JDownloads prior to a fixed version. The CVEs describe a critical remote code ex...

CVE-2026-61900 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6

The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61900

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-36669

CVE-2026-36669 affects Feng Office 3.11.13.11, targeting the ck_upload_handler.php component. The vulnerability is an unauthenticated arbitrary file upload that allows attackers to place files (e.g., .html) in the web-accessible /tmp directory. Reported CVSS v3.1: 9.8 (CRITICAL) with network atta...

Remote Code Execution (RCE)

github.com/julien040/anyquery, is vulnerable to Remote Code Execution RCE. The vulnerability is due to the server mode allowing unrestricted use of native SQLite ATTACH DATABASE commands, which allows an unauthenticated attacker to write arbitrary files to writable locations on the filesystem and...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

WordPress W3 Total Cache plugin <= 2.9.4 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by snr in WordPress Plugin W3 Total Cache versions = 2.9.4...

PT-2026-57990

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 through 2.0.0-milestone-12 Description Deployments using the MongoDB backend are subject to an unauthenticated arbitrary file write via the AAS thumbnail API. The issue occurs because t...

CVE-2026-6847

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary co...

EUVD-2026-43303

The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion...

CVE-2026-57830

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion...

CVE-2026-57830

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion...

CVE-2026-57827

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE...

EUVD-2026-43168

The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE...

CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.313 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by andrea bocchetti in WordPress Plugin Super Forms versions = 6.3.313...

CVE-2026-56291

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE...

PT-2026-56777

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.1 Description The Joomla extension Balbooa Forms, installed as the com baforms component, contains a flaw in its frontend attachment upload functionality. This issue allows an unauthenticated anonymous visit...