Fortinet FortiNAC - Arbitrary File Write

Fortinet FortiNAC is susceptible to arbitrary file write. An external control of the file name or path can allow an attacker to execute unauthorized code or commands via specifically crafted HTTP request, thus making it possible to obtain sensitive information, modify data, and/or execute...

EUVD-2026-84987

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

EUVD-2026-84978

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

CVE-2026-95830

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

CVE-2026-95830: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

PT-2026-97605

Name of the Vulnerable Software and Affected Versions Laravel-Mediable versions 7.0.0 through 7.0.1 Description An incomplete patch in the forbidden extensions blocklist within config/mediable.php allows the upload of files with the .pht extension. While other PHP-related extensions are blocked,...

PT-2026-97623

Name of the Vulnerable Software and Affected Versions SEMCMS versions prior to 4.3 Description A flaw exists in the KindEditor Upload Interface component within the file '/Edit/php/upload json.php'. Remote manipulation of the imgFile argument allows for cross-site scripting, a technique where...

CVE-2026-96513: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-5695: Unrestricted Upload of File with Dangerous Type

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configuration...

CVE-2026-96678: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

PT-2026-97267

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Authenticated users can upload files to the server without restrictions due to a lack of proper validation in upload forms. This flaw allows for arbitrary file...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...

PT-2026-97613

Name of the Vulnerable Software and Affected Versions weiqingwen spring-boot-forum versions up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f Description A path traversal issue exists in the Avatar Upload component. A remote attacker can exploit this by manipulating the Username argument within the...

CVE-2026-93352: Unrestricted Upload of File with Dangerous Type

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...

PT-2026-97400

Name of the Vulnerable Software and Affected Versions Neethuharii CafeManagement affected versions not specified Description A security flaw allows remote attackers to perform unrestricted file uploads. This occurs due to improper processing of the image argument within the 'AddProductCode.php'...

PT-2026-97658

Name of the Vulnerable Software and Affected Versions Drupal Webform affected versions not specified Description Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they ar...

CVE-2026-95830 theRealSain Pixtream post_upload.php unrestricted upload

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

CVE-2026-95830

A security flaw in theRealSain Pixtream (up to commit 866afd4f0cea812b918780fb74b67dccf8c4d6a0) allows for an unrestricted upload via remote manipulation of the media argument in the /post_upload.php file. This vulnerability can be exploited remotely, and a public exploit is currently available f...

CVE-2026-95830 theRealSain Pixtream post_upload.php unrestricted upload

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...