CVE-2026-93031

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

EUVD-2026-83414

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

CVE-2026-93031 WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

CVE-2026-93031 WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

CVE-2026-93031

CVE-2026-93031 affects four WordPress plugins from WP Cloud Plugins — Use-your-Drive , Out-of-the-Box , Share-one-Drive , and Lets-Box — in versions 2.0 through 3.8.3 . The vulnerability is an Authenticated (Subscriber+) Arbitrary File Upload via the download_file_to_uploads function. Three combi...

EUVD-2026-83250

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

CVE-2026-93506

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-93505

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

CVE-2026-77929

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

WordPress Gravity Forms plugin <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability

Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Gravity Forms versions = 3.1.0.4...

CVE-2026-93506

SveltyCMS 0.0.6 is affected by a server-side request forgery (SSRF) vulnerability in the File Upload Endpoint at /mediagallery/upload-media. The root cause is described as "unknown processing" within that component. A remote, authenticated attacker (low privileges required) can exploit this with ...

CVE-2026-93506 SveltyCMS File Upload Endpoint upload-media server-side request forgery

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

EUVD-2026-82980

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-93506 SveltyCMS File Upload Endpoint upload-media server-side request forgery

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-93506 SveltyCMS File Upload Endpoint upload-media server-side request forgery

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-77929 ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77929 ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77929 ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

EUVD-2026-82944

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77929

ClipBucket v5 before version 5.5.3-#182 is affected by a remote code execution vulnerability in the FileUpload::manageFile() function (fileupload.class.php). The function fails to update the file extension after MIME validation, so an authenticated user can upload a PHP file carrying valid image ...