CVE-2026-14698: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the file uploadfiles.php. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been...

CVE-2026-14776: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /uploadfiles.php of the component Filename Extension. Performing a manipulation results in unrestricted upload. Remote...

PT-2026-55784

A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user auth commit.php. Performing a manipulation of the argument upload image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has...

PT-2026-55834

A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /announcements.php. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has...

PT-2026-55833

Name of the Vulnerable Software and Affected Versions SourceCodester Onlne Examination & Learning Management System version 1.0 Description An unrestricted upload flaw exists within the Filename Extension component. The issue resides in the pathinfo function of the /upload files.php endpoint, whe...

CVE-2026-14636

A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the function douploadothersimages of the file application/modules/vendor/controllers/AddProduct.php of the component Vendor Image Manager. Executing a...

CVE-2026-14635

A security flaw has been discovered in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This issue affects some unknown processing of the file application/modules/vendor/controllers/AddProduct.php of the component Vendor Multi-Image Endpoint. Performing ...

Exploit for Improper Access Control in Joomlack Page_Builder_Ck

Mass Exploitation & Validation Framework for Joomla Page Bui...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the extensionsRequired field of glTF files processed by the 3D file viewer. An attacker can execute arbitrary JavaScript code in the context of another user by uploading a crafted glTF file containing malicio...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the extensionsRequired field of glTF files processed by the 3D file viewer. An attacker can execute arbitrary JavaScript code in the context of another user by uploading a crafted glTF file containing malicio...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to ambiguity in the HMAC validation of signed URLs used for artifact access. An attacker can gain unauthorized read access to artifacts across repositories and write to upload-state...

CVE-2026-58426

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...

CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

CVE-2017-12615 - Apache Tomcat Remote Code Execution RCE...

EUVD-2026-41489

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

pwnlift Symlink File Write

Symlink following and TOCTOU issues in the pwnlift upload handler allow arbitrary file write as root...

Adobe ColdFusion 2023.x < 2023u21 / 2025.x < 2025u10 Multiple Vulnerabilities (APSB26-68)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 21 or 2025.x update 10. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-68 advisory. - Unrestricted Upload of File with Dangerous Type potentially leading to Arbitrary...

Docker Engine < 29.5.1 Arbitrary Code Execution

The version of the Docker Engine Moby installed on the remote host is prior to 29.5.1. It is, therefore, affected by an arbitrary code execution vulnerability: - When a compressed archive is uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon resolves...

GHSA-9FX4-7CMJ-47VG Mautic has Server-Side Template Injection (SSTI) in Theme Templates

Summary A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code...

Mautic has Server-Side Template Injection (SSTI) in Theme Templates

Summary A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code...