16475 matches found
CVE-2026-14270: Unrestricted Upload of File with Dangerous Type
The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...
VulnCheck KEV: CVE-2026-65885
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker...
GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...
Exploit for Unrestricted Upload of File with Dangerous Type in Ollyo Sp_Page_Builder
🛡️ CVE-2026-48908 Analysis Unauthenticated Arbitrary File...
CVE-2026-10818
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
EUVD-2026-48766
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818: Unrestricted Upload of File with Dangerous Type
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
PT-2026-64474
Name of the Vulnerable Software and Affected Versions WPForms Pro versions prior to 1.10.1.2 Description An arbitrary file upload issue exists in the ajax chunk upload finalize function. The flaw occurs because file type validation is performed after the chunk metadata and file contents are writt...
WordPress GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin <= 1.12.2 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin GoDAM versions = 1.12.2...
CVE-2026-65455
Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...
CVE-2026-27064
Editor Arbitrary File Upload in Mailster = 4.1.17 versions...
CVE-2026-65461
The WordPress plugin Really Simple CSV Importer (vulnerable:
CVE-2026-65461 WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...
EUVD-2026-48225
Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...
CVE-2026-65461 WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...
EUVD-2026-48220
Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...
CVE-2026-65455 WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...
CVE-2026-65455
CVE-2026-65455 affects the WordPress MapSVG plugin up to version 8.14.0. The vulnerability is described as an Administrator Arbitrary File Upload, with an overall CVSSv3.1 base score of 9.1 (CRITICAL) and a network attack vector, requiring high privileges and no user interaction. The reports do n...