CVE-2026-18927: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

PT-2026-67978

Name of the Vulnerable Software and Affected Versions The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin versions prior to 3.0.8 Description The plugin fails to sanitize uploaded SVG files when the SVG upload feature is enabled. This allows...

PT-2026-68157

Name of the Vulnerable Software and Affected Versions Fledge affected versions not specified Description The backup-restore upload handler upload backup located in python/fledge/services/core/api/backup restore.py is susceptible to OS command injection. The handler processes the first extracted t...

CVE-2026-16583: Improper Neutralization of Input During Web Page Generation

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-54416: Unrestricted Upload of File with Dangerous Type

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

PT-2026-68119

Name of the Vulnerable Software and Affected Versions wp-downloadmanager versions 1.68.11 through 1.69.0 wp-downloadmanager versions 6.9.4 through 6.9.4 Description An admin-privileged user with manage downloads capabilities can upload arbitrary files through the 'download-add.php' endpoint. The...

PT-2026-68573

Name of the Vulnerable Software and Affected Versions Iptanus File Upload versions prior to 5.1.8 Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additiona...

CVE-2026-18933: Unrestricted Upload of File with Dangerous Type

The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...

PT-2026-68173

Name of the Vulnerable Software and Affected Versions wiseCampaign – WooCommerce Conversions Made Easy versions prior to 1.1.17 Description The plugin is susceptible to unauthorized data disclosure and modification because all REST API endpoints are registered with permission callback = ' return...

📄 ICS-Park Smart Park Management System 2.0 Cross Site Scripting

A proof of concept exploit for a cross site scripting vulnerability in ICS-Park Smart Park Management System version 2.0. An authenticated user can upload arbitrary HTML files because the upload whitelist permits .html and .htm extensions, resulting in stored cross site scripting when another use...

CVE-2026-60009: Cross-Site Request Forgery (CSRF)

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

CVE-2026-6147: Unrestricted Upload of File with Dangerous Type

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-14553: Unrestricted Upload of File with Dangerous Type

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

PT-2026-68021

Name of the Vulnerable Software and Affected Versions Pluck CMS versions prior to 4.7.22 Description The admin file-management feature fails to properly restrict dangerous file uploads. The system uses a fixed blacklist in data/inc/files.php that checks the last 4-5 characters of a filename but...

PT-2026-68156

Name of the Vulnerable Software and Affected Versions Fledge affected versions not specified Description The backup-restore upload handler upload backup python/fledge/services/core/api/backup restore.py fails to validate per-member paths or use a filter argument when calling tarfile.extractalltem...

PT-2026-68311

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A path traversal issue allows an unauthenticated attacker with network reachability to delete arbitrary files and directories on the instance, including the user storage directory...

VulnCheck KEV: CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

PT-2026-67969

Name of the Vulnerable Software and Affected Versions zportals WordPress plugin versions prior to 6.3.4 Description The plugin fails to properly validate uploaded files by trusting the client-supplied content type and preserving the original file extension. This allows any authenticated user with...

PT-2026-68095

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.73.2 Description The @theia/filesystem backend binds the 'POST /file-upload' endpoint in every filesystem-enabled deployment. The handler processes an absolute path provided by an attacker via the multipart ur...

py-djangorestframework -- two vulnerabilities

Bruno Alla reports: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data AdminRenderer may disclose GET-protected data when rendering invalid write requests...