81699 matches found
CVE-2026-71434
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...
CVE-2026-67688
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...
CVE-2026-19065
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...
GHSA-QHR7-V3XP-VW9M Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the assets or files fields in frontend forms. An attacker can upload disallowed file types by submitting specially crafted files through these fields, potentially bypassing intended administrative restrictions...
CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...
CVE-2026-19065 SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...
CVE-2026-19065
SourceCodester Online Examination & Learning Management System 1.0 contains a vulnerability in the file upload_files.php handling that allows unrestricted file upload. The issue is described as resulting from unknown processing in upload_files.php, with remote initiation possible. The CVSS-derive...
CVE-2026-19065 SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload
A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file uploadfiles.php. This manipulation causes unrestricted upload. The attack may be initiated remotely...
CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
CVE-2026-3418
The CVE-2026-3418 entry concerns the System REST API in multiple WSO2 products that allows arbitrary file uploads due to insufficient validation of file type/destination. The vulnerability enables an authenticated publisher (admin with publisher privileges) to upload files to server-accessible lo...
CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
CVE-2026-66665
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...
EUVD-2026-53891
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
