CVE-2026-57311

Windu CMS is affected by CVE-2026-57311 due to lack of validation for uploaded file types. An authenticated attacker can upload arbitrary files, including PHP, which can lead to Remote Code Execution. The vulnerability has been confirmed in version 4.1 and may affect other versions; the available...

PT-2026-61617

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

CVE-2026-60034: Improper Neutralization of Input During Web Page Generation

Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS...

PT-2026-61623

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...

Linux Distros Unpatched Vulnerability : CVE-2026-50151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a...

CVE-2026-48062

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

EUVD-2026-45325

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

EUVD-2026-45238

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowedextensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from...

CVE-2026-48015 Shopware: Stored XSS via SVG file upload — no SVG sanitization

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowedextensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from...

EUVD-2026-41914

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read...

CVE-2026-60024 Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0

Joomla Extension - joomdonation.com - Insecure default configuration Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets...

CVE-2026-60024 Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0

Joomla Extension - joomdonation.com - Insecure default configuration Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets...

PT-2026-60706

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed mime types function. This is due to the unconditional...

PT-2026-60849

Name of the Vulnerable Software and Affected Versions Feng Office version 3.11.13.11 Description An unauthenticated arbitrary file upload issue exists in the ck upload handler.php file. This allows remote attackers to upload malicious files, such as .html files, to the web-accessible /tmp/...

PT-2026-60786

Name of the Vulnerable Software and Affected Versions Events Booking versions prior to 5.8.0 Description An insecure default configuration allows unauthenticated users to upload media assets. Recommendations Update to version 5.8.0 or later...

CVE-2026-46336 Manyfold: Authenticated Path Traversal via File Rename

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

EUVD-2026-44877

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...

Cross-site Scripting (XSS)

EasyAdmin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient restrictions on uploaded file types and serving uploaded files inline from the public web root, which allows an attacker to upload malicious HTML or SVG files that execute JavaScript in an administrator'...

PT-2026-60419

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...