101 matches found
CVE-2026-86801
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
CVE-2026-86801
The To Do List Member WordPress plugin (versions 1.4 through 1.6 ) includes a file upload endpoint that fails to load WordPress, meaning no authentication , capability , or nonce checks are enforced. The endpoint validates only the uploaded file's name , not its content , allowing unauthenticated...
EUVD-2026-81384
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
CVE-2026-86801: Missing Authentication for Critical Function
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
CVE-2026-68899: Unrestricted Upload of File with Dangerous Type
Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...
CVE-2026-46426
Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped inside if isPublicUser or if isPublicUser ...
Exploit for CVE-2026-21509
🛡️ CVE-2026-21509 — Microsoft Office Zero-Day !OFFICEhttps...
CVE-2025-63830
CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...
CVE-2025-63830
CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...
CVE-2025-63830
CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...
CVE-2025-63830
CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...
EUVD-2015-2022
Malware in sbrugna...
EUVD-2009-3246
Malware in sbrugna...
EUVD-2013-0937
Malware in sbrugna...
EUVD-2007-1935
Malware in sbrugna...
EUVD-1999-0534
Malware in sbrugna...
EUVD-2006-4830
Malware in sbrugna...
EUVD-2010-5149
Malware in sbrugna...
CVE-2010-5190
The Active Content Transformation functionality in Blue Coat ProxySG before SGOS 4.3.4.2, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.2.1 allows remote attackers to bypass JavaScript detection via HTML entities...