86038 matches found
CVE-2026-68922
In MobSF versions before 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py constructs paths from the manifest android:icon value without sanitizing traversal or verifying containment. An authenticated user can upload a crafted ZIP/APK to read server files matching A...
CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads
MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...
GO-2026-6183 Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone
During WebDAV Infinite Scale TUS upload creation, a transport failure can return a nil HTTP response along with an error. When handling the failure, rclone dereferences the nil response before checking the error, causing a panic that can crash the process in unrecovered contexts such as VFS mount...
WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability
Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...
CVE-2026-73373
Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
CVE-2026-73373
Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
CVE-2026-73373
Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
CVE-2026-73373
This vulnerability affects Joomla! Core versions 1.0.0–5.4.7 and 6.0.0–6.1.2. The root cause is that the default list of dangerous files did not include SHTML files , allowing unrestricted uploads of these files. On servers configured to execute SHTML files, this can lead to remote code execution...
CVE-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
EUVD-2026-61026
Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
CVE-2026-73373
Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
CVE-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
CVE-2026-73996
Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...
CVE-2026-66627
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5...
CVE-2026-32474
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
Exploit for CVE-2026-15748
CVE-2026-15748 - Forminator Forms Unauthenticated RCE Cra...
GO-2026-6153 Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer
Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer...
GO-2026-6154 Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer
Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer...