CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16618

The Improve SEO WordPress plugin (versions

EUVD-2026-52578

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16618

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

Exploit for CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypas...

freo2 vulnerable to unrestricted upload of file with dangerous type

Overview freo2 provided by refirio is a content management system written in PHP. freo2 contains the following vulnerability. Unrestricted upload of file with dangerous type CWE-434 - CVE-2026-67243 Kazuki Ozawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/C...

EUVD-2026-52452

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11112 – XXE via SVG Image Upload Program C...

PT-2026-67666

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-18788: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

CVE-2026-14175: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-67243: Unrestricted Upload of File with Dangerous Type

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

CVE-2026-16618: Unrestricted Upload of File with Dangerous Type

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16548: Unrestricted Upload of File with Dangerous Type

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

PT-2026-67787

Name of the Vulnerable Software and Affected Versions Trippo ResponsiveFilemanager versions prior to 9.14.1 Description A remote flaw exists in an unknown function within the filemanager/dialog.php file. This issue allows for unrestricted upload of files to the server. Recommendations At the...

PT-2026-67678

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

VulnCheck KEV: CVE-2026-28409

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution RCE vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access which can be obtained via the previously reported...

PT-2026-67677

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...