87590 matches found
PT-2026-53415
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the file key and doc file.filename parameters are...
PT-2026-53392
Description There's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatical...
PT-2026-53413
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability...
PT-2026-53516
OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality...
CVE-2026-57957: Permissive Cross-domain Policy with Untrusted Domains
Papermark through 0.22.0 contains a cross-origin resource sharing CORS misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint reflecting arbitrary request Origins with...
CVE-2026-13553: Unrestricted Upload of File with Dangerous Type
A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/modamenities/controller.php?action=add. Executing a manipulation of the argument image can lead to unrestricted upload. It is possible to launch the attack remotely. The...
PT-2026-53580
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...
CVE-2026-13165: Unrestricted Upload of File with Dangerous Type
SzafirHost verifies the downloaded native library archive with one JarFile parser reading the Central Directory but extracts native libraries with JarInputStream parser reading sequentially from local file headers. An attacker who controls the served archive can insert a malicious DLL/SO/DYLIB as...
CVE-2026-13509
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.uploadfile/FileHandler.removefile of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely...
CVE-2026-13509 RAGapp Knowledge File files.py FileHandler.remove_file path traversal
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.uploadfile/FileHandler.removefile of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely...
CVE-2026-13509 RAGapp Knowledge File files.py FileHandler.remove_file path traversal
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.uploadfile/FileHandler.removefile of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely...
CVE-2026-13509
RAGapp up to 0.1.5 is affected. The vulnerability lies in FileHandler.upload_file and FileHandler.remove_file (src/ragapp/backend/controllers/files.py), enabling path traversal. Exploitation can be performed remotely, and public proof-of-concept/exploitation has been disclosed. A fix via a pull r...
Exploit for Unrestricted Upload of File with Dangerous Type in Devcode Openstamanager
CVE-2026-38751 — OpenSTAManager Module Upload RCE Authenticat...
ubilling-multi-vuln-cve
GitHub Security Advisory: Ubilling — Multiple Critical Vulnera...
Exploit for CVE-2025-56399
Laravel FileManager Unrestricted File Upload CVE-2025-56399...
doctorpatientportal-rce-sqli-cve
CVE-2026-XXXXX Unauthenticated Arbitrary File Upload RCE...
Exploit for OS Command Injection in Devcode Openstamanager
CVE-2025-69212 PoC - OpenSTAManager P7M Command Injection RCE...
student-registration-rce-sqli-cve
CVE-2026-XXXXX Unauthenticated Arbitrary File Upload RCE...
PT-2026-53165
Name of the Vulnerable Software and Affected Versions RAGapp versions prior to 0.1.6 Description A path traversal issue exists in the Knowledge File Handler component. This flaw allows remote attackers to manipulate files via the FileHandler.upload file and FileHandler.remove file functions locat...