16512 matches found
CVE-2026-57700
CVE-2026-57700 is an unrestricted file upload vulnerability in the WordPress plugin OMGF Pro by Daan.Dev, affecting versions through 5.2.6 . Discovered by NETZLICHT , the flaw allows unauthenticated attackers to upload malicious files of dangerous types, leading to remote code execution (RCE) on ...
CVE-2026-57700 WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6...
CVE-2026-57700 WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6...
WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by NETZLICHT in WordPress Plugin OMGF Pro versions = 5.2.6...
WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Theme Travel Booking versions = 2.2.5...
WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Quform versions = 2.23.0...
CVE-2025-71333: External Control of File Name or Path
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...
Exploit for CVE-2026-48908
🚨 CVE-2026-48908 — Full Server Compromise via Arbitrary File U...
Arbitrary File Upload
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Arbitrary File Upload through the Admin API /files/upload endpoint in ghost/core/core/server/api/endpoints/files.js. An attacker can make uploaded files be served with an attacker-chosen content type by...
Exploit for CVE-2026-48908
CVE-2026-48908 — SP Page Builder Unauthenticated RCE SP Pag...
WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Jakub Herman in WordPress Plugin Booster for WooCommerce versions = 8.0.1...
VulnCheck KEV: CVE-2025-7443
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the storejavascriptcache.php file in all versions up to, and including, 2.2.4...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the ticket attachments process. An attacker can execute arbitrary code, extract sensitive data, read credentials, and run system commands by uploading malicious files as an authenticated user. Workaround This...
EUVD-2025-26130
Paymenter vulnerable to Remote Code Execution via public file uploads...
Exploit for CVE-2026-48908
CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE...
CVE-2026-48500: Missing Authorization
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, so...
CVE-2026-48939
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution...
CVE-2026-48908
CVE-2026-48908 affects the Joomla extension SP Page Builder (com_sppagebuilder). Reports and PoCs confirm unauthenticated file upload via the asset.uploadCustomIcon task, allowing arbitrary files to be written to the webroot and potentially executing PHP code. Affected versions are 1.0.0 through ...
CVE-2026-48908 Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...