14679 matches found
CVE-2026-55744
Cotonti 1.0.0 (master, commit f43f1fc3) is vulnerable to CSRF in Personal File Storage (PFS). The file upload action (a=upload) in modules/pfs/inc/pfs.main.php does not call cot_check_xg() to validate the anti-CSRF token, unlike the delete action. A remote attacker could lure an authenticated use...
CVE-2026-55744 Cotonti CSRF in PFS allows forced arbitrary file upload
Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.main.php, the file upload action 'a=upload' processes uploaded files without calling cotcheckxg to validate the anti-CSRF token, even though...
CVE-2026-9815
The CVE-2026-9815 entry concerns the MagicForm WordPress plugin (versions up to 0.1.3). The affected component is the file upload path via an unauthenticated AJAX action, where the per-field extension allowlist being empty leads to improper validation of uploaded file types. As a result, unauthen...
CVE-2026-9815 MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server...
EUVD-2026-37627
Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...
EUVD-2026-37599
Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...
EUVD-2026-37601
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
EUVD-2026-37600
Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...
EUVD-2026-37598
Subscriber Arbitrary File Upload in Restaurant Zone = 0.7.8 versions...
EUVD-2026-37587
Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...
EUVD-2026-37668
Contributor Arbitrary File Upload in Unlimited Elements for Elementor Premium = 2.0.6 versions...
EUVD-2026-37667
Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...
EUVD-2026-37650
Subscriber Arbitrary File Upload in Restaurt = 1.0.4 versions...
EUVD-2024-55628
Subscriber Arbitrary File Upload in Grip = 1.0.9 versions...
EUVD-2025-210224
Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...
CVE-2026-40749
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
CVE-2026-27041
Contributor Arbitrary File Upload in Unlimited Elements for Elementor Premium = 2.0.6 versions...
CVE-2026-22327
Subscriber Arbitrary File Upload in Restaurt = 1.0.4 versions...