CVE-2026-56702

Adminer versions prior to 5.4.3 are affected by an unrestricted file upload vulnerability in the AdminerFileUpload plugin. The root cause is a permissive default extension allowlist that allows authenticated users to upload PHP files by targeting columns ending in _path. When the uploadPath direc...

CVE-2026-56702

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

Exploit for CVE-2026-32475

CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File...

EUVD-2026-65164

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-79670: Unrestricted Upload of File with Dangerous Type

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...

PT-2026-82001

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

PT-2026-81187

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

PT-2026-81316

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...

CVE-2026-38466: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remastercustomtitle parameter, which is stored during torrent upload or...

...[ More ]

This Metasploit module exploits CVE-2026-66066 in Ruby on Rails Active Storage when the application uses the Vips variant processor and accepts untrusted image uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text files accessible to the Rails worker through a PNG...

PT-2026-81848

Name of the Vulnerable Software and Affected Versions dbgpt-app versions prior to 0.8.1 Description An issue exists in the skill upload endpoint within packages/dbgpt-app/src/dbgpt app/openapi/api v1/agentic data api.py where the destination path for uploaded skills is constructed using the...

CVE-2026-16286: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...

CVE-2026-55419: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

PT-2026-81446

Name of the Vulnerable Software and Affected Versions Reachy Mini versions prior to 1.8.2 Description The Reachy Mini daemon exposes the '/api/media/sounds/upload' endpoint, implemented by the upload sound function, without authentication, file-extension checks, content validation, or size...

VulnCheck KEV: CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

PT-2026-81289

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...