PT-2026-79287

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

Fedora 43 : wordpress (2026-61704c09ea)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-61704c09ea advisory. WordPress 6.9.7 Release Security update included in this release - Authenticated Author+ remote code execution via malicious file upload on sites th...

CVE-2026-77681: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

PT-2026-79420

Name of the Vulnerable Software and Affected Versions Checkmate versions prior to 3.9.1 Description An unauthenticated attacker can cause a denial of service by submitting concurrent oversized files to the 'POST /api/v1/auth/register' endpoint. The application uses in-memory Multer parsing for th...

PT-2026-79286

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...

PT-2026-79436

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...

PT-2026-82325

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40 Description The filer's TUS resumable-upload handler fails to verify JWT allowed prefixes scoping after a session is created. This allows a low-privilege tenant who obtains another user's session identifier to...

CVE-2026-67361: Cross-Site Request Forgery (CSRF)

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...

CVE-2026-76158: External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-18781: Improper Control of Generation of Code

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

VulnCheck KEV: CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

PT-2026-79306

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.9 Description An issue exists where the plugin fails to validate the final name of an uploaded file after stripping characters from it. This allows unauthenticated...

CVE-2026-14325: Improper Neutralization of Input During Web Page Generation

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

PT-2026-80003

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the upload files capability This issue affects all versions of WordPress...

PT-2026-80004

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the upload files capability This issue affects all versions of WordPress...

PT-2026-79350

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-48753: External Control of File Name or Path

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

CVE-2026-76157: Missing Authentication for Critical Function

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...

PT-2026-79299

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.9 Description Insufficient escaping of a setting used as an HTML tag name in front-end output allows users with administrator access to perform a Stored Cross-Site...

The vulnerability of SITI-Navigator software, related to deficiencies in access control, allows a perpetrator to upload arbitrary files.

The vulnerability of SITI-Navigator software is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to upload arbitrary files...