CVE-2026-24727

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727

The CVE-2026-24727 entry describes an unrestricted file upload vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System (v10.3). An authenticated administrator can upload a crafted ZIP archive containing a server-executable file to achieve remote code exec...

CVE-2026-24727

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

Class06-Security-Vulnerability-Demo

Class04: Fixing Cross-Origin Vulnerabilities and Business Logi...

Exploit for Incorrect Authorization in Adobe Coldfusion

CVE-2025-43564 — Apache Tomcat Partial PUT Request Handling RC...

Exploit for Path Traversal in Connectwise Screenconnect

CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Auth...

WordPress GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin <= 1.12.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin GoDAM versions = 1.12.2...

PT-2026-64270

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...

PT-2026-64474

Name of the Vulnerable Software and Affected Versions WPForms Pro versions prior to 1.10.1.2 Description An arbitrary file upload issue exists in the ajax chunk upload finalize function. The flaw occurs because file type validation is performed after the chunk metadata and file contents are writt...

PT-2026-67626

Impact In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any BASIC app user to obtain S3 PutObject presigned URLs. The endpoint uses TABLE/WRITE permission level instead of the intended BUILDER level defined in v3.39.3. Additionally, the...

CVE-2026-24727: Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

PT-2026-64263

Name of the Vulnerable Software and Affected Versions SUNNET Corporate Training Management System versions prior to 10.4 Description The e-paper draft upload function contains a flaw that allows remote authenticated users with administrator privileges to execute arbitrary commands. This is achiev...

PT-2026-64433

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description Cloudreve contains an issue where the built-in image decoders for PNG, JPEG, and GIF formats limit only the compressed file size but do not restrict the decoded pixel dimensions. An authenticated...

Security Bulletin: Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS

Summary Unauthenticated users can upload unlimited files to the Langflow OSS server via the deprecated /api/v1/upload/flowid endpoint without authentication or validation, leading to potential disk space exhaustion DoS and information disclosure through absolute file path leakage in API responses...

CVE-2026-63765 Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...

SUSE CVE-2026-65315

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

CVE-2026-65690

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...

CVE-2026-8287 Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects Online Pre-Accounting Software: through 17072026...