16467 matches found
CVE-2025-61165
An arbitrary file upload vulnerability exists in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 . This flaw allows an attacker to execute arbitrary code by uploading a crafted file. The vulnerability has a CRITICAL severity score of 9.8, with high impacts on confidentiality, in...
CVE-2025-61165: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...
PT-2026-81989
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
PT-2026-81983
Name of the Vulnerable Software and Affected Versions EFence affected versions not specified Description An arbitrary file upload flaw allows unauthenticated remote attackers to upload and execute web shell backdoors, which can lead to arbitrary code execution on the server. Recommendations At th...
PT-2026-81981
CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-75327: Unrestricted Upload of File with Dangerous Type
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...
CVE-2026-80050 ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints
ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...
CVE-2026-80050
ContiNew Admin versions through 4.1.0 contain a missing authorization and file-type allowlist vulnerability in its multipart upload endpoints (specifically MultipartUploadController). Authenticated users can initialize chunked uploads, send file parts, and complete uploads with arbitrary file ext...
WordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000027 - Editor+ Arbitrary File Upload vulnerability
Editor+ Arbitrary File Upload vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Insert or Embed Articulate Content into WordPress versions = 4.3000000027...
WordPress Zportals plugin < 6.3.4 - Subscriber+ Arbitrary File Upload vulnerability
Subscriber+ Arbitrary File Upload vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Zportals versions 6.3.4...
WordPress MagicForm plugin <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE vulnerability
Unauthenticated Arbitrary File Upload to RCE vulnerability discovered by 0xBassia in WordPress Plugin MagicForm versions = 0.1.3...
EUVD-2026-65313
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...
CVE-2026-16601
CM Map Locations for WordPress (all versions ≤ 2.1.8 ) is vulnerable to limited arbitrary file upload via the cmloc_route_image_upload AJAX action. The uploadMedia function performs incomplete extension filtering without MIME-type checks or upload capability verification before calling move_uploa...
Arbitrary File Upload
Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Arbitrary File Upload via the AdminerFileUpload process. An attacker can achieve remote code execution by uploading malicious PHP files to columns ending with path and executing...
EUVD-2026-65164
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
CVE-2026-16601: Unrestricted Upload of File with Dangerous Type
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...
PT-2026-81485
ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...
CVE-2026-32559
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
CVE-2026-32559
UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...
