PT-2026-51175

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An authorization bypass exists in the Meet plugin's 'uploadRecordedVideo.json.php' endpoint. The system derives the target users id from the uploaded filename without proper verification. An attacker w...

PT-2026-51146

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description The software fails to strip EXIF metadata, which includes GPS geolocation data, from uploaded images. This leads to information disclosure, as attackers can download these images and extract precise...

CVE-2026-48908: Unrestricted Upload of File with Dangerous Type

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...

Zhejiang Dahua Technology Co., Ltd.'s DSS has a file upload vulnerability

Zhejiang Dahua Technology Co., Ltd. is a provider and operator of intelligent IoT solutions, with video as its core technology. Zhejiang Dahua Technology Co., Ltd. DSS has a file upload vulnerability; attackers can exploit this vulnerability to upload files with any extension...

CVE-2026-48939: Unrestricted Upload of File with Dangerous Type

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...

Langflow: Unauthenticated DoS through multipart form boundary file upload

Summary An attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. Details...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the upload function. An attacker can cause the server to become unresponsive for all users by sending a specially crafted multipart form-data request with an excessively long...

GHSA-QWQC-P3Q8-WCG9 Langflow: Unauthenticated DoS through multipart form boundary file upload

Summary An attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. Details...

Cross-site Scripting (XSS)

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the file upload extension check in FilesRouter in src/FilesRouter and FilesController. An...

parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Impact Parse Server's default fileUpload.fileExtensions blocklist is intended to prevent uploading files that browsers render as active content such as HTML and SVG, which can be used to perform stored cross-site scripting XSS attacks against other users. The blocklist could be bypassed by...

GHSA-V8X7-R927-CC93 parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Impact Parse Server's default fileUpload.fileExtensions blocklist is intended to prevent uploading files that browsers render as active content such as HTML and SVG, which can be used to perform stored cross-site scripting XSS attacks against other users. The blocklist could be bypassed by...

NPM: parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

NPM: parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist vulnerability discovered by ? in WordPress Npm parse-server versions = 8.6.80...

CVE-2019-25758

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profilepic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and...

CVE-2019-25758 Joomla! Component vBizz 1.0.7 Remote Code Execution

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profilepic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and...

CVE-2019-25758

CVE-2019-25758 affects Joomla! component vBizz 1.0.7. The vulnerability is an unrestricted file upload in the profile_pic parameter, enabling authenticated attackers to upload arbitrary PHP files. By submitting malicious files via POST to the employee view endpoint, attackers can place PHP code i...

EUVD-2019-20194

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profilepic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and...

CVE-2019-25758

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profilepic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and...

CVE-2019-25758 Joomla! Component vBizz 1.0.7 Remote Code Execution

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profilepic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and...

DotVVM: Unrestricted file upload

Impact All users of DotVVM with configured file upload storage are affected. DotVVM allows anyone to upload files to the application, potentially causing denial of service by filling the disk. Patches Since version 4.3.15, 4.2.11 and 5.0.0-preview09, DotVVM requires all file upload request to hav...

Arbitrary File Upload

Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload process. An attacker can exhaust disk space by uploading arbitrary...