CVE-2026-78274

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78274 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78274

CVE-2026-78274 affects the WordPress Fluent Boards Pro plugin in versions

EUVD-2026-66937

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78274 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

WordPress ImproveSEO plugin <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by João Ramos Maciel in WordPress Plugin Improve SEO versions = 2.0.11...

CVE-2026-77018

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77018

The Workeera Remote Tech Job Board WordPress plugin (versions before 1.0.6 ) is vulnerable to arbitrary file upload due to a lack of restriction on candidate profile values and insufficient file type validation. Attackers with privileges as low as subscriber can submit profile values that cause t...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

EUVD-2026-66880

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-81485

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

CVE-2026-81485

linkedin-ads-mcp (danielpopamd) version 1.0.0 is affected by a path traversal vulnerability in the Media Upload component. The root cause is the fs.readFileSync function in src/tools/campaign-management.ts, where the filePath argument is not properly validated, allowing a remote attacker to read ...

CVE-2026-81485 danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

EUVD-2026-66832

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

CVE-2026-81485 danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

EUVD-2026-66801

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-75339

The software cjbi admin3 v3.0.0 is vulnerable to an authorization bypass due to missing permission checks on the /storage/upload endpoint. This flaw allows any logged-in user to upload arbitrary files to the server. Additionally, the vulnerability allows any anonymous attacker to download the fil...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82554

Name of the Vulnerable Software and Affected Versions Eclipse SW360 versions 19.0.0 through 20.1.0 Description When the system is configured to use file system storage via the enable.attachment.store.to.file.system config key, an attacker can manipulate the filename during upload. This allows for...