8506 matches found
CVE-2026-14289
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file...
PT-2026-64959
Name of the Vulnerable Software and Affected Versions NitroShare Desktop versions prior to 0.3.5 Description The LAN file transfer server contains a path traversal issue that allows unauthenticated attackers on the same network to write arbitrary files. This occurs because the server fails to...
Exploit for CVE-2026-10818
CVE-2026-10818 WPForms Pro = 1.10.1.1 - Unauthenticated Ar...
PT-2026-71448
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.57 Description Insufficient guarding of git option forwarding in the IndexFile.checkout and TagReference.create functions allows attackers to pass unsafe options via kwargs. This can be exploited using the...
CVE-2026-10818
WPForms Pro (WordPress) is affected by an Arbitrary File Upload vulnerability up to version 1.10.1.1, exploitable via the ajax_chunk_upload_finalize path. The issue arises because file type validation occurs after chunk metadata and file contents are written to disk, and the assembled file isn’t ...
CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
GO-2026-5452 Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write in github.com/MontFerret/ferret
Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write in github.com/MontFerret/ferret...
GO-2026-5593 ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego
ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego...
GO-2026-5666 Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm...
GHSA-4VV7-JJ25-4GH6 Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Summary Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/--class-name ...
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Summary Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/--class-name ...
GHSA-4RJ6-VRWV-WR8M Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...
CVE-2026-66004
BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...
CVE-2026-66004 BlenderMCP Path Traversal via download_polyhaven_asset API
BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...
K000162431: Spring Integration vulnerability CVE-2026-40987
Security Advisory Description A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0...
CVE-2026-7483
Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...
CVE-2026-7483
CVE-2026-7483 describes a local privilege escalation in ESET security applications for macOS that potentially allows a low-privilege attacker to write an arbitrary file with content under a privileged user. The initial and connected documents state the impact as high on confidentiality, integrity...
