EUVD-2026-54982

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19383 saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19383

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19383

This CVE affects saithink/saigroup SaiAdmin (up to version 5.0.1). The vulnerability lies in the shell_exec usage within /app/saipackage/install/upload of the Plugin Upload Endpoint, enabling unrestricted file upload. The issue is exploited remotely and publicly disclosed; exploit code/methods ar...

EUVD-2026-54959

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19383: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-17019: Improper Neutralization of Input During Web Page Generation

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...

PT-2026-69852

Name of the Vulnerable Software and Affected Versions OpenCart version 4.2.0.0 Description The extension installer fails to validate that extracted paths from uploaded .ocmod.zip files remain within the intended directory. This allows an attacker to use directory traversal sequences, such as ../,...

CVE-2026-72583: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-19089: Unrestricted Upload of File with Dangerous Type

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-72592: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

PT-2026-69476

Name of the Vulnerable Software and Affected Versions dulldusk/phpfm versions prior to 1.8.1 Description An unrestricted file upload issue allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application is configured by default with an empty upload extension...

PT-2026-69355

Name of the Vulnerable Software and Affected Versions Squeeze WordPress plugin versions prior to 1.7.12 Description Insufficient validation of file types or extensions during attachment-update actions allows users with the upload files capability, such as those with Author privileges and above, t...

PT-2026-69327

Name of the Vulnerable Software and Affected Versions saithink/saigroup SaiAdmin versions prior to 5.0.2 Description A flaw in the Plugin Upload Endpoint allows for unrestricted file upload. This issue occurs within the shell exec function located in the /app/saipackage/install/upload file,...

CVE-2026-16985: Unrestricted Upload of File with Dangerous Type

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

PT-2026-69460

Name of the Vulnerable Software and Affected Versions Bludit version 4.0.0-beta Description A stored cross-site scripting XSS issue allows a low-privileged authenticated user with the Author role to inject arbitrary JavaScript. This occurs when a crafted SVG file is uploaded as the site logo via...

📄 WordPress 7.0.2 Code Execution / Cross Site Scripting

A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...

PT-2026-69383

Name of the Vulnerable Software and Affected Versions Product Input Fields for WooCommerce versions prior to 2.0.2 Description An issue exists where the plugin fails to validate uploaded file types when the accepted-types setting is left empty. This configuration, which is advertised in the...

PT-2026-69478

Name of the Vulnerable Software and Affected Versions lobehub/lobe-chat versions prior to 2.2.14 Description A stored cross-site scripting XSS issue exists where a low-privileged authenticated user can inject arbitrary JavaScript into the application. This occurs because the avatar upload handler...

Breeze Cache Plugin Code Execution

The vulnerability of the fetchgravatarfromremote function in the Breeze Cache plugin of the WordPress content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...