WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...

WP Time Capsule Plugin - Remote Code Execution

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...

Alcatel-Lucent OmniPCX - Remote Command Execution

The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter. id: CVE-2007-3010 info: name: Alcatel-Lucent OmniPCX - Remote Command Execution author: king-alexander severity: critical description: | The OmniPCX web interface has a scrip...

Juniper J-Web - Remote Code Execution

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands id: CVE-2023-36845 info: name: Juniper J-Web - Remote Code...

EUVD-2026-100770

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...

EUVD-2026-100766

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-107652 Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1.4.1 . The root cause is that the plugin stores arbitrary submission fields in its db7_forms row. The process_bulk_action() delete handler matches any store...

CVE-2026-93388 Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url

The Printcart Store PCDesigner / NB Designer plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesignercopyimagefromurl AJAX action is registered for logged-out callers wpajaxnopriv, and...

EUVD-2026-100765

The Printcart Store PCDesigner / NB Designer plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesignercopyimagefromurl AJAX action is registered for logged-out callers wpajaxnopriv, and...

CVE-2026-93388

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in versions up to and including 2.9.1 . The vulnerability exists because the nbdesigner_copy_image_from_url AJAX action is registered for l...

CVE-2025-3616

Metasploit Module: Greenshift WordPress Plugin Arbitrary File Upload CVE-2025-3616 This repository contains a Metasploit module to exploit CVE-2025-3616 , an arbitrary file upload vulnerability in the Greenshift WordPress plugin versions 11.4 through 11.4.5. The exploit allows authenticated users...

CVE-2025-56499

CVE-2025-56499 Arbitrary File Read via Missing Path Validation in Local Rule Provider Upstream Fix: https://github.com/MetaCubeX/mihomo/pull/2177 Affected Versions: mihomo = v1.19.11 Summary When parsing rule-providers configuration, the type = "file" branch fails to validate the supplied path. A...

CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI RCE CVE-2020-5902 is a critical unauthenticated Remote Code Execution RCE vulnerability in the F5 BIG-IP Traffic Management User Interface TMUI / Configuration utility. 📌 Overview Disclosed by F5 on June 30, 2020 NVD published July 1, 2020, this flaw allowed...

CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read

CVE-2025-2539 - File Away WordPress Plugin Arbitrary File Read 📋 Executive Summary CVE ID: CVE-2025-2539 Plugin: File Away Versions = 3.9.9.0.1 Vulnerability Type: Authenticated Arbitrary File Read CVSS Score: 8.5 High Exploit Availability: Public PoC Available Impact: Unauthorized file disclosur...

CVE-2025-52691

CVE-2025-52691 SmarterMail Unauthenticated Arbitrary File Upload RCE Overview Critical unauthenticated arbitrary file upload allowing remote code execution. Field| Value ---|--- Product| SmarterMail Affected| Build 9406 and earlier CVSS| 10.0 Critical Type| Arbitrary File Upload Vector| HTTP...

CLEANSTART-2026-OF55498 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Security vulnerability affects the wave package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...

EUVD-2026-100644

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

EUVD-2026-100714

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended...

CVE-2026-92817

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these...