CVE-2026-18351

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...

EUVD-2026-75229

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

CVE-2026-84063

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

CVE-2026-84063

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

CVE-2024-9932

CVE-2024-9932 Wux Blog Editor = 3.0.0 - Unauthenticated Arbitrary File Upload Description: The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This...

CVE-2024-48914

This post is a research article published by EQSTLab. Thanks toRajesh Sharma, who discovered this vulnerability. CVE-2024-48914 ★ CVE-2024-48914 Arbitrary File Read and DoS PoC ★ Description CVE-2024-48914 : vendure-ecommerce Arbitrary file read and DoS Vulnerability description: Vendure is an...

eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCE

Exploit Title : eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE Date : 5/18/19 Exploit Author : liquidsky Joseph McPeters Vulnerable Software : eLabFTW 1.8.5 Vendor Homepage : https://www.elabftw.net/ Version : 1.8.5 Software Link : https://doc.elabftw.net/ Tested On : Linux / PHP...

CVE-2026-26336-PoC

CVE-2026-26336 — Alfresco Share Unauthenticated File Read Overview Alfresco Share exposes a /share/page/resource/ endpoint used to serve static resources. In vulnerable versions, this endpoint does not properly restrict path traversal, allowing an unauthenticated attacker to read arbitrary files...

CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla

CVE-2026-21627 Unauthenticated Arbitrary File Inclusion in Joomla's Novarain Framework nrframework Overview A critical vulnerability in the Tassos/Novarain Framework plgsystemnrframework Joomla plugin allows unauthenticated attackers to include arbitrary PHP files on the server, instantiate...

imagemagick-lfi-poc

ImageMagick LFI PoC CVE-2022-44268 The researchers at MetabaseQ discovered CVE-2022-44268, i.e. ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image e.g., for resize, the resulting image could have embedded the content of an arbitrary remote file if the...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...

CVE-2026-4350

CVE-2026-4350 - Perfmatters WordPress Arbitrary File Deletion Description CVE-2026-4350 is an arbitrary file deletion vulnerability in the Perfmatters WordPress plugin. CVE Details CVE: CVE-2026-4350 Severity: HIGH CVSS: 8.1 Affected Plugin: Perfmatters Affected Version: = 2.5.9.1 Exploit python3...

CVE-2021-43798-poc

CVE-2021-43798-poc Grafana8.x Arbitrary File Read python CVE-2021-43798-poc.py http://152.136.149.237:3000 /etc/passwd...

CVE-2026-29780

Path Traversal in Official Example Script Leading to Arbitrary File Write Summary The official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows arbitrary file write outside the intended output directory. Attachment filenames extracted fr...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...

CVE-2021-43798

CVE-2021-43798 Grafana unauthorized arbitrary file reading vulnerability On December 4, 2021, a security researcher revealed an arbitrary file reading vulnerability in Grafana on the Internet. Unauthorized attackers can use this vulnerability to obtain sensitive files on the server. The...

CVE-2026-18351 Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

CVE-2026-18351

The Drag and Drop File Upload for Elementor Forms WordPress plugin is vulnerable to an unauthenticated arbitrary file upload in versions up to and including 1.6.0 . The root cause lies in the is_file_type_valid() function, which uses the attacker-controlled type parameter as regex keys within the...

EUVD-2026-75227

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...