86457 matches found
CVE-2026-74845
CVE-2026-74845 concerns the Official Document Management System by 2100 Technology, with an Arbitrary File Upload vulnerability that enables authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. From the connected references, ...
CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-74845
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
BIT-GHOST-2026-70593 Ghost: Theme Upload Path Traversal
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...
CVE-2026-67678
The RainyGao-Hithub DocSys v.2.02.80 software is affected by a File Upload vulnerability that allows a remote attacker to execute arbitrary code . The vulnerability is categorized with a CRITICAL severity score of 9.8 (CVSS v3.1), indicating a high impact on confidentiality, integrity, and availa...
CVE-2026-67678
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...
EUVD-2026-60358
File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...
CVE-2026-50768
A File Upload vulnerability exists in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 . This flaw allows a remote attacker to achieve arbitrary code execution by exploiting the add attachments feature within the create new document function. While the impact is high, no specific reme...
CVE-2026-50768
File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...
PT-2026-76740
File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...
CVE-2026-40126: Improper Neutralization of Input During Web Page Generation
OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...
CVE-2026-74845: Unrestricted Upload of File with Dangerous Type
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-16137: Improper Limitation of a Pathname to a Restricted Directory
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result...
CVE-2026-67925: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...
CVE-2026-65640: Unrestricted Upload of File with Dangerous Type
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...
CVE-2026-67678: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...
PT-2026-73247
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, Discourse has HTML injection in PrettyText.format for email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag...
CVE-2026-67925
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...
PT-2026-76630
openssl encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify api token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any...