freo2 vulnerable to unrestricted upload of file with dangerous type

Overview freo2 provided by refirio is a content management system written in PHP. freo2 contains the following vulnerability. Unrestricted upload of file with dangerous type CWE-434 - CVE-2026-67243 Kazuki Ozawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/C...

EUVD-2026-52452

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11112 – XXE via SVG Image Upload Program C...

CVE-2026-16548: Unrestricted Upload of File with Dangerous Type

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

PT-2026-67678

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67677

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

PT-2026-67666

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-18788: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

CVE-2026-14175: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-16618: Unrestricted Upload of File with Dangerous Type

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

VulnCheck KEV: CVE-2026-28409

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution RCE vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access which can be obtained via the previously reported...

CVE-2026-67243: Unrestricted Upload of File with Dangerous Type

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

PT-2026-67787

Name of the Vulnerable Software and Affected Versions Trippo ResponsiveFilemanager versions prior to 9.14.1 Description A remote flaw exists in an unknown function within the filemanager/dialog.php file. This issue allows for unrestricted upload of files to the server. Recommendations At the...

CVE-2026-18682

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-18682 OpenAkita File Upload API upload cross site scripting

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-18682

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-18682

OpenAkita up to version 1.27.12 is affected by a cross-site scripting (XSS) vulnerability in the File Upload API (/api/upload). The issue arises from manipulated input in the File argument, with remote exploitation possible. The vulnerability has a high attack complexity, with exploit maturity de...

CVE-2026-18682 OpenAkita File Upload API upload cross site scripting

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-61524

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

EUVD-2026-52394

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...