WP Attachment Export < 0.2.4 - Unrestricted File Download

The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress powered site. This includes details of even privately published posts and password protected posts with their passwords revealed ...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

Zimbra Collaboration Suite - Cross-site Scripting

Cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. id:...

CVE-2026-49849

xShop is an open-source e-commerce platform built with Laravel . Version 3.0.3 contains an Unrestricted File Upload vulnerability in the File Attachment Module within the Admin panel. An authenticated administrator can upload executable files (e.g., .php), enabling Remote Code Execution (RCE) and...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-74465

A flaw was found in the Linux kernel's Open vSwitch OVS component. When a new meter is attached, the attachmeter function makes it visible to other central processing units CPUs before all checks are complete. If the attachment fails, the meter is freed without waiting for other CPUs to stop usin...

WordPress Easy Media Replace plugin <= 0.2.0 - Author+ Stored XSS via Attachment Title vulnerability

Author+ Stored XSS via Attachment Title vulnerability discovered by testoun in WordPress Plugin Easy Media Replace versions = 0.2.0...

EUVD-2026-62915

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76350

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76350

CVE-2026-76350 is an improper privilege management vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . A user holding the schedule_search role capability can configure PDF attachments in the email alert action workflow. When the alert fires, the search...

CVE-2026-76350 Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-68899

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

EUVD-2026-62706

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

EUVD-2026-62702

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-76215 phpMyFAQ before 4.1.7 Missing Authorization via child resources

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

EUVD-2026-62268

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...

CVE-2026-15253 Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...

CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...