85786 matches found
CVE-2026-81889
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...
CVE-2026-81780
Unauthenticated Arbitrary File Upload in Hash Form = 1.4.2 versions...
CVE-2026-71415
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...
CVE-2026-61639
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-54179
backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and...
CVE-2026-82921 ShopEx ECShop pack.php check_img_type unrestricted upload
A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function checkimgtype of the file admin/pack.php. Executing a manipulation of the argument packimg can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to th...
CVE-2026-82921
ShopEx ECShop up to 2.5.1 is affected by an unrestricted file upload vulnerability in the check_img_type function within admin/pack.php . Manipulating the pack_img argument allows a remote attacker with no privileges and no user interaction to upload arbitrary files. The vulnerability is rated CV...
CVE-2026-82921 ShopEx ECShop pack.php check_img_type unrestricted upload
A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function checkimgtype of the file admin/pack.php. Executing a manipulation of the argument packimg can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to th...
EUVD-2026-68808
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...
CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...
CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...
CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...
CVE-2026-71415
Kirby CMS (versions 5.0.0–5.5.2) contains a flaw in its REST API chunk upload handler (src/Api/Upload.php). The method Kirby\Api\Upload::process() failed to execute the relevant upload authorization preflight before processChunk() persisted chunk data. An authenticated user holding the access.pan...
CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...
CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...
CVE-2026-81891
elFinder (open-source web file manager) is vulnerable to remote code execution prior to version 2.1.70 . The flaw resides in checkExtractItems() in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, ...
CVE-2026-81780
Hash Form is a WordPress plugin affected by an unauthenticated arbitrary file upload vulnerability in versions