16474 matches found
CVE-2026-74803
The Joomla Zoo extension (versions before 4.1.64) accepts arbitrary files via its image element when the client-supplied Content-Type falls within the image MIME group, enabling unauthenticated remote code execution. No exploitation details are provided; update to Zoo 4.1.64 or later. CVSS 4.0 sc...
CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...
CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...
WordPress Easy Dropbox Integration plugin < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX vulnerability
Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Easy Integration for Dropbox versions 2.2.0...
WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by nh4tvd in WordPress Plugin Media LIbrary Assistant versions = 3.39...
PT-2026-78448
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root path type could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token...
PT-2026-78366
Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated arbitrary file upload issue exists in the image element. The system accepts arbitrary files as long as the client-supplied Content-Type falls within the image MIME group Multipurpose...
CVE-2026-75949: Unrestricted Upload of File with Dangerous Type
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...
CVE-2026-74803: Unrestricted Upload of File with Dangerous Type
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...
WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability
Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...
CVE-2026-73996
Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...
CVE-2026-66627
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5...
CVE-2026-32474
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
CVE-2026-32463
Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...
CVE-2026-28192
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...
CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...
CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...
CVE-2026-73996
The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.
