CVE-2026-67678

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

CVE-2026-40126: Improper Neutralization of Input During Web Page Generation

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

CVE-2026-50768

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-74845: Unrestricted Upload of File with Dangerous Type

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2026-76740

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

PT-2026-76651

Name of the Vulnerable Software and Affected Versions In Progress ShareFile Storage Zones Controller versions prior to 5.12.6 Description A party with valid zone credentials can perform path traversal via the resumable upload initiation endpoint. This allows the party to write arbitrary content t...

Budibase 3.31.4 Authentication Bypass / Remote Code Execution

Budibase versions through 3.31.4 contain an authentication and authorization bypass vulnerability that allows an unauthenticated remote attacker to access protected API endpoints by placing a webhook route pattern in the request query string. This proof of concept first verifies the bypass agains...

CVE-2026-67925

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

CVE-2026-67678: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

EUVD-2026-60536

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

CVE-2026-16137: Improper Limitation of a Pathname to a Restricted Directory

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result...

PT-2026-76767

Name of the Vulnerable Software and Affected Versions Forminator versions prior to the patch released in response to this disclosure Description An unauthenticated arbitrary file upload flaw allows an attacker to upload malicious PHP files to the server, leading to Remote Code Execution RCE, whic...

PT-2026-76791

Name of the Vulnerable Software and Affected Versions JeecgBoot version 3.9.2 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code through the '/airag/chat/upload' endpoint. Recommendations At the moment, there is no information about a newer version tha...

CVE-2026-65640: Unrestricted Upload of File with Dangerous Type

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...

CVE-2026-67678

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

EUVD-2026-60358

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-50768

A File Upload vulnerability exists in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 . This flaw allows a remote attacker to achieve arbitrary code execution by exploiting the add attachments feature within the create new document function. While the impact is high, no specific reme...

PT-2026-76595

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-67925

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

PT-2026-76772

Name of the Vulnerable Software and Affected Versions RainyGao-Hithub DocSys version 2.02.80 Description A file upload flaw allows a remote attacker to execute arbitrary code on the system. Recommendations At the moment, there is no information about a newer version that contains a fix for this...