CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

CVE-2026-66492

Phoca Commander (Joomla extension by phoca.cz) versions 1.0.0-6.1.3 expose a path traversal vulnerability in the file upload action, caused by improper limitation/validation of upload paths. This results in a path traversal flaw within the module. The connected documents confirm the affected prod...

EUVD-2026-54411

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

CVE-2026-66492

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

CVE-2026-66492

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

OESA-2026-3251 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through...

[SECURITY] Fedora 43 Update: curl-8.15.0-8.fc43

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

EUVD-2026-54309

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

EUVD-2026-54209

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

EUVD-2026-54215

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...

PT-2026-69383

Name of the Vulnerable Software and Affected Versions Product Input Fields for WooCommerce versions prior to 2.0.2 Description An issue exists where the plugin fails to validate uploaded file types when the accepted-types setting is left empty. This configuration, which is advertised in the...

CVE-2026-19210: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=saveupload. Such manipulation of the argument img/imgName leads to unrestricted upload. The attack may be launched remotely. The exploit has be...

CVE-2022-4995: Unrestricted Upload of File with Dangerous Type

Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...

CVE-2026-66492: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

PT-2026-69066

Name of the Vulnerable Software and Affected Versions SourceCodester Photo Share Website version 1.0 Description An unrestricted upload issue exists in the /social/ajax.php?action=save upload endpoint. Remote attackers can exploit this by manipulating the img and imgName variables, allowing the...

PT-2026-69048

Name of the Vulnerable Software and Affected Versions Weaver Fanwei E-cology 9.0 versions prior to 10.52 Description A file upload issue allows a remote, unauthenticated attacker to upload arbitrary files, such as JSP webshells. This is achieved by submitting a multipart/form-data POST request to...

PT-2026-68906

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application contains file upload functionalities susceptible to a buffer overflow. An unauthenticated attacker can cause a server crash and a subsequent denial of service by...

PT-2026-68886

Name of the Vulnerable Software and Affected Versions Phoca Commander versions 1.0.0 through 6.1.3 Description Improper limitation of paths in the file upload action allows for a path traversal, which occurs when an application uses user-controllable input to construct a pathname that is used in ...

Node.js Module axios 1.7.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67317)

The version of the axios Node.js module installed on the remote host is 1.7.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers ca...

CVE-2026-71434

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...