CVE-2026-80235: Unrestricted Upload of File with Dangerous Type

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

PT-2026-82239

An arbitrary file upload vulnerability in the /v1/my drive/batch upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-75327

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...

CVE-2026-75331: Unrestricted Upload of File with Dangerous Type

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-80233: Unrestricted Upload of File with Dangerous Type

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2026-75331

The software tamguo version 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS . The root cause is a lack of file type validation in the /uploadFile and /imgUpload endpoints, specifically within the FileUploadController.java and UEditorController.java components. This allows at...

PT-2026-82081

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save attachments function. This is due to missing file extension validation and missing path normalization wh...

PT-2026-81989

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2026-81934

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

CVE-2026-75327

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...

CVE-2026-75327: Unrestricted Upload of File with Dangerous Type

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...

PT-2026-82321

Name of the Vulnerable Software and Affected Versions tamguo version 1.5.3 Description An unrestricted file upload issue allows for stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on the target server. The '/uploadFile' and '/imgUpload' endpoints within...

CVE-2025-61165

An arbitrary file upload vulnerability exists in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 . This flaw allows an attacker to execute arbitrary code by uploading a crafted file. The vulnerability has a CRITICAL severity score of 9.8, with high impacts on confidentiality, in...

PT-2026-82263

Name of the Vulnerable Software and Affected Versions DocSys-master version 2.02.85 Description An arbitrary file upload issue exists in the 'uploadMarkdownPic' interface within the src/com/DocSystem/controller/DocController.java file. This allows an attacker to upload unauthorized files to the...

CVE-2026-38466

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remastercustomtitle parameter, which is stored during torrent upload or...

EUVD-2026-66108

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...