PT-2026-68778

Name of the Vulnerable Software and Affected Versions ICS-Park Smart Park Management System version 2.0 Description The file upload module contains an unrestricted file upload flaw. This allows a remote attacker to upload malicious files and execute arbitrary code on the system. Recommendations A...

CVE-2026-19065: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...

CVE-2026-18325: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-68581

Name of the Vulnerable Software and Affected Versions Type Hub versions prior to 2.0.7 Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files to the server without providing credentials. Recommendations Update to a version newer than 2.0.6...

PT-2026-68978

Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...

PT-2026-68724

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The System REST API fails to properly validate file types or destinations during user-supplied file uploads. This allows an authenticated user with administrativ...

CVE-2025-15678: Improper Neutralization of Input During Web Page Generation

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

CVE-2026-67688

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

PT-2026-68396

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for WooCommerce versions prior to 1.1.8 Description An issue exists where unauthenticated users can obtain a valid nonce, which is the sole security control for the file-deletion routine. This allows anonymou...

PT-2026-68671

Name of the Vulnerable Software and Affected Versions SourceCodester Online Examination & Learning Management System version 1.0 Description An issue exists in the processing of the 'upload files.php' endpoint, which allows for unrestricted file upload. This flaw can be exploited remotely to uplo...

CVE-2026-67688: Unrestricted Upload of File with Dangerous Type

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

CVE-2026-3418: Unrestricted Upload of File with Dangerous Type

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

CVE-2026-16054: External Control of File Name or Path

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and...

CVE-2026-71434: Unrestricted Upload of File with Dangerous Type

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

PT-2026-68802

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.3 Statamic versions prior to 6.24.2 Description Public frontend forms fail to enforce the file upload restrictions configured in the Control Panel. This allows an unauthenticated visitor to upload file types tha...

CVE-2026-70558: Unrestricted Upload of File with Dangerous Type

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-18969: Unrestricted Upload of File with Dangerous Type

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...

CVE-2026-66447: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-18969 Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...

CVE-2026-18969 Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...