85729 matches found
CVE-2015-10144
creationtimestamp| type| source ---|---|--- 2026-09-08 06:50:22+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wpresponsivethumbnailsliderupload.rb...
EUVD-2026-72533
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...
EUVD-2026-72532
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
PT-2026-88461
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
PT-2026-88460
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...
CVE-2026-86666: Unrestricted Upload of File with Dangerous Type
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...
CVE-2026-78738: Improper Neutralization of Input During Web Page Generation
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...
PT-2026-87169
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...
CVE-2026-78738
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...
EUVD-2026-74261
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...
CVE-2026-48707: Server-Side Request Forgery (SSRF)
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...
PT-2026-87190
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...
CVE-2026-78741: Improper Neutralization of Input During Web Page Generation
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-50093: Unrestricted Upload of File with Dangerous Type
A vulnerability has been identified in Siveillance Control Pro V3.0 All versions V3.0.12.2173, Siveillance Control Pro V4.0 All versions V4.0.9.2178, Siveillance Control V3.0 All versions V3.0.22.2177, Siveillance Control V4.0 All versions V4.0.11.2177. A vulnerability in the OIS web module allow...
PT-2026-87002
Name of the Vulnerable Software and Affected Versions Siveillance Control Pro versions prior to 3.0.12.2173 Siveillance Control Pro versions prior to 4.0.9.2178 Siveillance Control versions prior to 3.0.22.2177 Siveillance Control versions prior to 4.0.11.2177 Description A flaw in the OIS web...
PT-2026-87046
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-77097: Missing Authentication for Critical Function
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-78738
The Silverpeas Core 6.4.6 software is vulnerable to Cross Site Scripting (XSS) . The flaw exists within the Document management file upload feature , where improper neutralization of input during web page generation allows for script execution. Exploitation details and specific remediation steps ...
