86346 matches found
CVE-2026-64960
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
On July 24th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with an estimated 6,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
EUVD-2026-63360
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
CVE-2026-64960
ATutor (version 2.2.4 confirmed) contains a remote code execution vulnerability in the Gameme module due to unrestricted file uploads. Uploaded files are stored in a web-accessible location before content validation, allowing an authenticated attacker to upload a server-executable script and trig...
CVE-2026-74014
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CVE-2026-74016
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74018
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-66600
Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...
EUVD-2026-63318
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-74018
CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...
CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-74014
A Subscriber (low-privileged WordPress user) in the IT Residence theme
CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74014 WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
EUVD-2026-63317
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74016
The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...