CVE-2026-64949: Unrestricted Upload of File with Dangerous Type

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64947: Unrestricted Upload of File with Dangerous Type

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

Rocky Linux 10.0 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14179)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514179 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 10.0 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14178)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514178 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2024_7699)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20247699 advisory. thunderbird: 115.16/128.3 firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service CVE-2024-9399 firefox: thunderbird:...

CVE-2022-1329

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 リモートコード実行 Ngày: 16 tháng 4 năm 2023 Khai thác Tác giả: Việt Hùng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://elementor.com/ Link phần mềm: https://wordpress.org/plugins/elementor/advanced/ kéo xuống chọn phiên bản Phiên...

Worpress-CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 自動シェルアップロード WordPress Royal Elementor 1.3.78 シェルアップロード Visit https://phankz.com...

CVE-2026-92247

SynaptikCMS ファイルマネージャー — 認証済み RCE 脆弱性 SynaptikCMS ファイルマネージャー 認証済みリモートコード実行 SynaptikCMS のファイルマネージャーでは、認証済みの攻撃者がファイルをアップロードし、その後そのファイルを PHP ファイルにリネームすることが可能です。このアップロードおよびリネームの動作を悪用することで、実行可能な PHP コードを Web からアクセス可能な場所に配置でき、結果として Web サーバーのコンテキストでリモートコード実行が可能になります。 研究者: D1n3sh 影響を受けるコンポーネント...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x 認証済みRCE ⚠️ 法的警告 ：このコードは教育目的および 許可されたテスト（CTF、バグバウンティ、プライベートラボ）専用として提供されています。 作者は不正使用に対して一切の責任を負いません。 説明 Krayin CRM（Webkul）≤ 2.2.x はエンドポイント /admin/tinymce/upload を公開しており、 これにより認証済みユーザー（低権限であっても）が拡張子の検証なしに ファイルをアップロードできます。その後ファイルは storage/ フォルダから...

CVE-2026-51866

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-102143

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...

CVE-2026-102137

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...

CVE-2026-102130

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...

CVE-2023-54402

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

vuln-chain-lab

ファイルアップロードバイパス + ストアドXSS PoC Lab CSP、CORS、CSRFの保護が有効な状態でも、ファイルアップロードのバイパスとストアドXSSを連鎖させてバックドア管理者アカウントを作成する方法を示す、意図的に脆弱性を持たせたWebアプリケーション。 完全なブログ記事: KurtiseBear Blog これは防御的なセキュリティトレーニングのための教育用ラボです。公開アクセス可能な場所にデプロイしないでください。 このラボが示すもの このアプリケーションには実際のセキュリティ対策が実装されています: コンテンツセキュリティポリシー CSP により、スクリプトソースを...

CVE-2023-54402 iDocView SSRF via /doc/upload Endpoint Hardcoded Token

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

CVE-2023-54402

The software iDocView is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its /doc/upload endpoint. Remote unauthenticated attackers can bypass authentication by using a hardcoded default token value (testtoken ) to fetch arbitrary URLs. Due to unrestricted URL scheme handling, includin...

CVE-2026-102130 Kiteworks Email Protection Gateway Remote Code Execution

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...

CVE-2026-102130

The Kiteworks Email Protection Gateway is vulnerable to Remote Code Execution (RCE) due to insufficient validation of uploaded backup content. An authenticated administrator can influence how the application loads these backups to execute arbitrary code on the gateway as the underlying service ac...

CVE-2026-102137 Kiteworks Core Unrestricted Upload of File with Dangerous Type

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...