CVE-2026-34213

CVE-2026-34213 Un usuario de Docmost con pocos privilegios podría proporcionar un attachmentId de una víctima al endpoint de carga genérico y sobrescribir el archivo adjunto de otra página dentro del mismo espacio de trabajo. Introducción Identifiqué, divulgué responsablemente y reproduje una fal...

PT-2026-91205

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2025-8889

Exploit Title: WordPress Compress Then Upload Plugin 1.0.3 Arbitrary File Upload to RCE Date: 2025-07-23 Exploit Author: Muhammed Çelik Vendor Homepage: https://wordpress.com/plugins/compress-then-upload Software Link: https://downloads.wordpress.org/plugin/compress-then-upload.latest-stable.zip...

CVE-2025-61506

An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint. Vulnerability: Unrestricted File Upload CWE-434 CVE ID: CVE-2025-61506 DISCOVRED : 18 september ASSIGNED : 9 october Affected Component:...

CVE-2026-5027

Esta publicación es un artículo de investigación publicado por EQSTLab. Gracias aYahia Hamza, quien reportó y analizó esta vulnerabilidad. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Escritura Arbitraria de Archivos PoC ★ Descripción CVE-2026-5027: Vulnerabilidad de Escritura Arbitrar...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Proof of concept Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ The python script abuses the upload function that is availible unauthenticated at /admin/files-upload/ The script locally creates a bin folder and a file named...

EUVD-2026-75207

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

PT-2026-89721

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2026-75308

yshopmall =3.3 is vulnerable to Cross Site Scripting XSS. The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files...

PT-2026-84863

Name of the Vulnerable Software and Affected Versions UnoPim versions prior to 2.1.5 Description Authenticated administrators can upload arbitrary PHP files through the TinyMCE image upload endpoint because the system fails to validate file extensions and MIME types. This allows an attacker to...

CVE-2026-55419

Reachy Mini (an SDK by Pollen Robotics for controlling Reachy Mini robots) prior to 1.8.2 exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS (allow_ori...

CVE-2026-79670

Ech0 before 4.4.3 contains a stored cross-site scripting (XSS) vulnerability in its file upload endpoint . The root cause is that the endpoint validates the Content-Type header using only client-supplied values without performing server-side inspection of the uploaded file. An attacker with admin...

CVE-2026-67925

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

EUVD-2026-60536

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

CVE-2026-19927

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...

CVE-2026-19927

CVE-2026-19927 affects OpenBoxes up to 0.9.7, specifically the Upload endpoint in grails-app/controllers/org/pih/warehouse/product/ProductController.groovy. The issue arises from manipulating the argument params.url, enabling a server-side request forgery (SSRF) that can be exploited remotely. Ex...

CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...

CVE-2026-73034 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-72557

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72576

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...