CVE-2026-19065

SourceCodester Online Examination & Learning Management System 1.0 contains a vulnerability in the file upload_files.php handling that allows unrestricted file upload. The issue is described as resulting from unknown processing in upload_files.php, with remote initiation possible. The CVSS-derive...

CVE-2026-3418

The CVE-2026-3418 entry concerns the System REST API in multiple WSO2 products that allows arbitrary file uploads due to insufficient validation of file type/destination. The vulnerability enables an authenticated publisher (admin with publisher privileges) to upload files to server-accessible lo...

CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

Malicious code in alphalend-layouts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install...

MAL-2026-13473 Malicious code in alphalend-layouts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install...

CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66447

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66665

CVE-2026-66665 affects the WordPress Type Hub plugin (versions

EUVD-2026-53891

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66447 WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

EUVD-2026-53883

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66447 WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66447

CVE-2026-66447 : Unauthenticated SQL Injection in WordPress File Upload plugin

CVE-2026-66447

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

WordPress Instant Appointment CVE-2026-15282 Detect

Detects Instant Appointment = 1.2 vulnerable to CVE-2026-15282: unauthenticated addservicefront AJAX writes arbitrary files via filegetcontentsimageurl + fileputcontentsimagename. Fixed in .... !/usr/bin/env python3 -- coding: utf-8 -- """Detect Instant Appointment CVE-2026-15282 = 1.2...

WordPress Podlove Podcast Publisher RCE (CVE-2026-13001)

Exploits CVE-2026-13001 in Podlove Podcast Publisher = 4.5.1: serves a GIF89a polyglot built from the configured framework payload, triggers the image-cache fetch shell.php?.gif bypass, then executes the cached PHP via HTTP reversetcp connects back through the normal listener. !/usr/bin/env pytho...