GHSA-RMPP-8WF5-XX5Q Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m273-6v24-x4m4. This link is maintained to preserve external references. Original Description picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangero...

EUVD-2026-37715

Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...

EUVD-2026-37647

Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...

EUVD-2026-37627

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...

EUVD-2026-37599

Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...

EUVD-2026-37593

CP Client Arbitrary File Download in Client Portal Pro = 5.6.2 versions...

EUVD-2026-37601

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

EUVD-2026-37598

Subscriber Arbitrary File Upload in Restaurant Zone = 0.7.8 versions...

EUVD-2026-37600

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

EUVD-2026-37587

Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...

EUVD-2026-37668

Contributor Arbitrary File Upload in Unlimited Elements for Elementor Premium = 2.0.6 versions...

EUVD-2026-37669

Unauthenticated Arbitrary File Deletion in BookPro = 1.1.0 versions...

EUVD-2026-37667

Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...

EUVD-2026-37656

Subscriber Arbitrary File Download in Woocommerce Book Price = 1.3 versions...

EUVD-2026-37650

Subscriber Arbitrary File Upload in Restaurt = 1.0.4 versions...

EUVD-2025-210225

Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot = 13.6.5 versions...

EUVD-2024-55628

Subscriber Arbitrary File Upload in Grip = 1.0.9 versions...

EUVD-2025-210224

Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...

CVE-2025-71321

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.fileutil.writefile. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code...

CVE-2026-53872 picklescan - Arbitrary File Read via Unsafe Pickle Deserialization

picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to externa...