85727 matches found
CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE
CVE-2025-69906: Monstra CMS 3.0.4 – Beliebiges Datei-Upload zu RCE Autor : David PS Abraham Datum : 5. Februar 2026 Schweregrad : Kritisch – Remote Code Execution CVSS 8.8+ CWE : 434 Unbeschränkter Upload von Dateien mit gefährlichem Typ Schwachstellenbeschreibung Das Files Manager-Plugin von...
CVE-2026-105695
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105686
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105389
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...
CVE-2020-23591
CVE-2020-23591 OPTILINK E-PON „MODEL NO: OP-XT71000N“ mit „HARDWARE VERSION: V2.2“; & „FIRMWARE VERSION: OPV3.3.1-191028“ Gefundene Schwachstelle im „OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028“, die einem Angreifer erlaubt, beliebige Dateien über...
CVE-2026-1405
CVE-2026-1405 Slider Future = 1.0.5 - Nicht authentifizierter Upload beliebiger Dateien 🚀 CVE-2026-1405.py — Slider Future Massen-Exploit-Tool 🩸 Schwachstellenübersicht Komponente: Slider Future WordPress-Plugin Betroffene Versionen: ≤ 1.0.5 Schwachstelle: Nicht authentifizierter Upload beliebige...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
EUVD-2026-92714
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105695
The open-source design and prototyping platform Penpot contains a missing authorization vulnerability in its chunked-upload assembly functionality. Prior to version 2.18.0 , the assemble-chunks function retrieves an upload session using only its session ID, failing to scope the lookup to the auth...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-48908-Joomla-SP-Page-Builder-RCE
🛡️ CVE-2026-48908-Analyse Nicht authentifizierter beliebiger Datei-Upload zu RCE im JoomShaper SP Page Builder -critical?style=for-the-badge&logo=alert -black?style=for-the-badge&logo=github Eine umfassende technische Aufschlüsselung einer nicht authentifizierten...
CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail
ConcreteCMS Stored XSS v.9.2.1 Autor: Sergio Beschreibung: ConcreteCMS v9.2.1 ist von einer Schwachstelle für beliebigen Dateiupload betroffen, die gespeichertes Cross-Site Scripting XSS ermöglicht. Angriffsvektoren: Eine Schwachstelle in der Bereinigung des Thumbnail-Dateiuploads ermöglicht das...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
EUVD-2026-92779
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105686
The open-source design and prototyping platform Penpot is vulnerable to temporary-storage amplification in versions prior to 2.18.0 . The issue exists within the chunked media upload RPC , which fails to reject or replace previously stored chunk indexes. An authenticated user can repeatedly uploa...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2022-3992
CVE-2022-3992 Cross-Site Scripting in WonderCMS Descrizione: Una vulnerabilità di cross-site scripting XSS in Sanitization Management System v1.0 consente a potenziali aggressori di caricare file arbitrari tramite un nome appositamente creato nei campi del logo del sistema nei campi delle...