73419 matches found
PT-2026-84018
Name of the Vulnerable Software and Affected Versions Hash Form versions 1.4.2 and earlier Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files, such as a web shell, without requiring authentication. Recommendations Update Hash Form to a version...
VulnCheck KEV: CVE-2026-82970
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1...
PT-2026-84020
Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description URL uploads in php/elFinder.class.php can bypass server-side request forgery SSRF protections when PHP cURL is unavailable. The validate address function validates the IP address, but get remote...
CVE-2026-51728
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-82472
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...
CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...
CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...
CVE-2026-82472
Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. This allows unauthenticated attackers to upload arbitrary PDF files indefinitely, potentially exhausting storage resources or filling the database with unlinked...
EUVD-2026-68128
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...
CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...
CVE-2026-14494
CVE-2026-14494 is a critical (CVSS 9.8) unauthenticated Remote Code Execution vulnerability in the Sigma Forms Pro plugin for WordPress, affecting all versions up to and including 1.4.5 . The flaw resides in the handle_form_submission function, which dynamically grants the unfiltered_upload capab...
CVE-2026-14494 Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...
CVE-2026-76548
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...
EUVD-2026-68052
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...
CVE-2026-76548
CVE-2026-76548 affects the User Profile Builder WordPress plugin in versions before 4.0.1 . The front-end file upload feature fails to properly restrict access, granting unauthenticated visitors capabilities normally reserved for privileged roles. This allows attackers to list the site's media li...
CVE-2026-76548 Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...
PT-2026-83429
Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...
CVE-2026-77037
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...
CVE-2026-75122
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...