EUVD-2026-84987

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

EUVD-2026-84978

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

CVE-2026-95830

A security flaw in theRealSain Pixtream (up to commit 866afd4f0cea812b918780fb74b67dccf8c4d6a0) allows for an unrestricted upload via remote manipulation of the media argument in the /post_upload.php file. This vulnerability can be exploited remotely, and a public exploit is currently available f...

CVE-2026-95820

The software anirbandutta9 College-Notes-Gallery (up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6) is vulnerable to an unrestricted upload flaw. The issue resides in an unknown functionality within the file /dashboard/userprofile.php?section=admin1 , where manipulating the image argument al...

CVE-2026-95500

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-95499

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

EUVD-2026-84426

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-95500

JosephChuks php-file-manager-with-code-editor up to version 3.0 is affected by an unrestricted file upload vulnerability in the Save Handler component. The flaw resides in the file_put_contents function within codeEditor.php, where manipulation of the filename/content argument allows a remote att...

CVE-2026-95499

CVE-2026-95499 affects JosephChuks php-file-manager-with-code-editor up to version 3.0 . The flaw resides in the move_uploaded_file function within filemanager.php , where manipulation of the files argument permits unrestricted file upload by a remote, unauthenticated attacker. The CVSS v3.1 base...

EUVD-2026-84393

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2025-39401

CVE-2025-39401 Плагин WordPress WPAMS Плагин WordPress WPAMS CVE: CVE-2025-39401 Базовая оценка: 10.0 КРИТИЧЕСКИЙ Уязвимость неограниченной загрузки файлов с опасным типом в mojoomla WPAMS позволяет злоумышленникам загрузить веб-шелл на сервер, что приводит к полной компрометации. Это затрагивает...

CVE-2020-13671

CVE-2020-13671 RCE через загрузку файлов — ядро Drupal Программное обеспечение: Drupal Core 8.7.5 Затронуты: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Неограниченная загрузка файла опасного типа CISA KEV: Да — известная эксплуатируемая уязвимость Advisory:...

CVE-2020-13671-old

CVE-2020-13671 RCE через загрузку файла — ядро Drupal Программное обеспечение: Drupal Core 8.7.5 Затронуты: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 Высокий CWE: CWE-434 — Неограниченная загрузка файла опасного типа CISA KEV: Да — известная эксплуатируемая уязвимость Advisory:...

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE

CVE-2025-69906: Monstra CMS 3.0.4 Произвольная загрузка файлов с удалённым выполнением кода RCE Автор : David PS Abraham Дата : 5 февраля 2026 г. Степень опасности : Критическая — удалённое выполнение кода CVSS 8.8+ CWE : 434 Неограниченная загрузка файла опасного типа Описание уязвимости Плагин...

CVE-2020-12800

CVE-2020-12800 Скрипт POC для CVE-2020-12800: RCE через неограниченную загрузку файлов Уязвимый плагин для тестирования расположен по адресу: https://mega.nz/file/aQUClQKCZYeiTYSrPuRnwwlRavy4cqfEXs34Tkq6KQig2RcOas Лаборатория Pentester Academy...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector — Эксплойт произвольной загрузки файлов CVE-2024-56264 Обзор Этот репозиторий содержит эксплойт для CVE-2024-56264 — уязвимости произвольной загрузки файлов , обнаруженной в плагине WordPress ACF City Selector версии = 1.14.0. Данная уязвимость позволяет...

CVE-2026-36467

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-36467

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...