CVE-2026-93352 Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...

CVE-2026-93352

Laravel-Mediable versions 7.0.0 before 7.0.2 are vulnerable to remote code execution due to an incomplete patch for CVE-2026-49972. The forbidden_extensions blocklist in config/mediable.php includes phpt but omits .pht. On Debian and Ubuntu systems, Apache may execute .pht files as PHP via the de...

CVE-2026-96513

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-96513 Neethuharii CafeManagement AddProductCode.php unrestricted upload

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

EUVD-2026-85419

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-96513

A security flaw in Neethuharii CafeManagement allows for unrestricted upload due to improper processing of the AddProductCode.php file. By manipulating the image argument, an attacker can perform this action remotely. Public exploits for this vulnerability are available. Because the product uses ...

CVE-2026-96513 Neethuharii CafeManagement AddProductCode.php unrestricted upload

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

DRUPAL-CONTRIB-2026-172

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...

DRUPAL-CONTRIB-2026-169

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configuration...

CVE-2026-5695

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

CVE-2026-5695 Multiple vulnerabilities in the Microweber administration panel

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

EUVD-2026-85219

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

CVE-2026-5695 Multiple vulnerabilities in the Microweber administration panel

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

CVE-2026-5695

The Microweber administration panel is vulnerable to an arbitrary file upload vulnerability caused by a lack of proper validation in upload forms. This flaw allows authenticated users to upload files to the server without restrictions. An attacker can exploit this to execute malicious code remote...

CVE-2026-75799 YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

CVE-2026-75799 YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

CVE-2026-75799

The YAHMAN Add-ons WordPress plugin, in versions before 0.9.31 , is vulnerable to an unauthenticated arbitrary file upload due to a lack of validation for remote files cached in a publicly accessible directory. An unauthenticated attacker can exploit this to write arbitrary PHP files on the serve...

Fortinet FortiNAC - Arbitrary File Write

Fortinet FortiNAC is susceptible to arbitrary file write. An external control of the file name or path can allow an attacker to execute unauthorized code or commands via specifically crafted HTTP request, thus making it possible to obtain sensitive information, modify data, and/or execute...

EUVD-2026-84987

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

EUVD-2026-84978

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...