86097 matches found
CVE-2026-19210: Unrestricted Upload of File with Dangerous Type
A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=saveupload. Such manipulation of the argument img/imgName leads to unrestricted upload. The attack may be launched remotely. The exploit has be...
PT-2026-69066
Name of the Vulnerable Software and Affected Versions SourceCodester Photo Share Website version 1.0 Description An unrestricted upload issue exists in the /social/ajax.php?action=save upload endpoint. Remote attackers can exploit this by manipulating the img and imgName variables, allowing the...
PT-2026-68886
Name of the Vulnerable Software and Affected Versions Phoca Commander versions 1.0.0 through 6.1.3 Description Improper limitation of paths in the file upload action allows for a path traversal, which occurs when an application uses user-controllable input to construct a pathname that is used in ...
Node.js Module axios 1.7.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67317)
The version of the axios Node.js module installed on the remote host is 1.7.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers ca...
CVE-2026-71434
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...
CVE-2026-67688
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...
CVE-2026-19065
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the assets or files fields in frontend forms. An attacker can upload disallowed file types by submitting specially crafted files through these fields, potentially bypassing intended administrative restrictions...
GHSA-QHR7-V3XP-VW9M Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...
CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...
CVE-2026-19065 SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...
CVE-2026-19065 SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...
CVE-2026-19065
SourceCodester Online Examination & Learning Management System 1.0 contains a vulnerability in the file upload_files.php handling that allows unrestricted file upload. The issue is described as resulting from unknown processing in upload_files.php, with remote initiation possible. The CVSS-derive...
CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
CVE-2026-3418
The CVE-2026-3418 entry concerns the System REST API in multiple WSO2 products that allows arbitrary file uploads due to insufficient validation of file type/destination. The vulnerability enables an authenticated publisher (admin with publisher privileges) to upload files to server-accessible lo...
CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
Malicious code in alphalend-layouts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install...
MAL-2026-13473 Malicious code in alphalend-layouts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install...