86354 matches found
VulnCheck KEV: CVE-2022-50973
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...
PT-2026-54945
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach files function in versions up to, and including, 3.3.29. This is due to the get files for attachment function accepting a raw attacker-controlled 'files' array when the process method returns...
CVE-2024-14037: Unrestricted Upload of File with Dangerous Type
Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed...
CVE-2026-5524: Unrestricted Upload of File with Dangerous Type
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the doimageupload function where user-supplied input from the acceptFileTypes POST...
CVE-2026-27419: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Zegen = 1.1.9 versions...
PT-2026-54977
Subscriber Arbitrary File Upload in Zegen = 1.1.9 versions...
PT-2026-55198
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do image upload function where user-supplied input from the acceptFileTypes PO...
PT-2026-55384
Summary A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code...
PT-2026-54948
Name of the Vulnerable Software and Affected Versions PIA affected versions not specified Description The OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check instead of validating the issuer as a properly host-bounded URL. This allows an attacker to bypass the check using a...
PT-2026-55493
Name of the Vulnerable Software and Affected Versions WP Import Export Lite versions prior to 3.9.31 Description An issue exists in the wpie import upload file from url AJAX action. The plugin initially uses wp safe remote get to download files, which blocks private IP ranges. However, if this ca...
PT-2026-55263
Name of the Vulnerable Software and Affected Versions Redsea Cloud eHR affected versions not specified Description An arbitrary file upload flaw allows unauthenticated attackers to achieve remote code execution. By sending a multipart POST request to the 'PtFjk.mob' servlet endpoint, an attacker...
PT-2026-55262
Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description An unauthenticated arbitrary file upload issue exists in the com.sksoft.bill.ImageUpload servlet. Unauthenticated attackers can upload arbitrary files by submitting a POST request to the endpoint without...
CVE-2026-14336: Server-Side Request Forgery (SSRF)
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...
Virtuozzo Infrastructure 7.2 Hotfix 3 (7.2.0-263)
This update delivers important security and stability fixes. Vulnerability id: VSTOR-123887 Stale S3 lifecycle timestamps could cause objects to expire at incorrect times. Vulnerability id: VSTOR-126525, VSTOR-131507 Extended usage reporting could omit CPU, RAM, storage tier, VPN, floating IP, an...
Exploit for OS Command Injection in Devcode Openstamanager
CVE-2025-69212 --- Description OpenSTAManager is a manag...
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags Ecosystem: Go Package: goshs.de/goshs/v2 github.com/patrickhener/goshs Affected: /tmp/r/x.txt goshs -p 18000 -wp 18001 -w -ro -d /tmp/r -b admin:pw & curl -u admin:pw -X PUT http://localhost:18000/y.txt --data x 403 HT...
GHSA-3WHC-QVHV-XQJP goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags Ecosystem: Go Package: goshs.de/goshs/v2 github.com/patrickhener/goshs Affected: /tmp/r/x.txt goshs -p 18000 -wp 18001 -w -ro -d /tmp/r -b admin:pw & curl -u admin:pw -X PUT http://localhost:18000/y.txt --data x 403 HT...
GHSA-VH4V-2XQ2-G5CG ORAS Go forwards registry credentials across registry redirects
ORAS Go forwards registry credentials across registry redirects Reporter / public credit: JUNYI LIU Summary ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects. There are two related paths: 1. A manifest or metadata...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the Authorization header being forwarded during HTTP redirects or blob upload Location responses across registry origins. An attacker can obtain registry credentials intended for one origin by...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the Authorization header being forwarded during HTTP redirects or blob upload Location responses across registry origins. An attacker can obtain registry credentials intended for one origin by...