EUVD-2026-125228

NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understat...

CVE-2026-126293

NocoDB versions prior to 2026.06.2 are vulnerable to an attachment size limit bypass via the v3 upload-by-URL endpoint. The root cause is located in data-attachment-v3.service.ts , which improperly trusts the remote server's advertised content length. This allows authenticated Editor users to upl...

CVE-2026-126306 EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a...

CVE-2026-126306

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw allows low-privileged users to upload crafted SVG images designed to submit authenticated POST requests to arbitrary backend endpoints. An attacker can trick an admi...

CVE-2026-126390

The software n8n (versions before 1.123.89 ) is vulnerable to a credential leakage vulnerability within the NocoDB node . The root cause occurs when the node downloads attachments; if an attacker has write access to a NocoDB attachment cell, they can insert a URL pointing to a host they control. ...

CVE-2026-127084

The Teable application, in versions prior to 2026-10-12T12-45-53Z.3331 , is vulnerable to Stored Cross-Site Scripting (XSS) via attachment uploads. The root cause allows authenticated users to upload SVG or HTML attachments using an attacker-chosen content type. Attackers can then direct victims ...

CVE-2026-127084 Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty...

CVE-2026-118065

The Advance Guest Post WordPress plugin (version 1.9 and below ) is vulnerable to unauthenticated deletion of media attachments. The root cause is a lack of authorization or ownership checks during the deletion process, as the plugin relies solely on a nonce that is accessible to all site visitor...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

WP Attachment Export < 0.2.4 - Unrestricted File Download

The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress powered site. This includes details of even privately published posts and password protected posts with their passwords revealed ...

Zimbra Collaboration Suite - Cross-site Scripting

Cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. id:...

Docmost 0.2.1-0.21.0 - Arbitrary File Read

Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL. id: CVE-2025-57231 info: name: Docmost 0.2.1-0.21.0 - Arbitrary File Read author: anirbala98 severity: high...

CVE-2025-32432

CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Authentication Remote Code Execution in Craft CMS Affected: Craft CMS 3.x, 4.x, and 5.x up to 5.6.16 Info: This exploit is tested against HackTheBox Orion machine Overview This repository contains a proof-of-concept exploit for CVE-2025-32432...

netfence

Netfence Like Envoy xDS, but for eBPF filters. Netfence runs as a daemon on your VM/container hosts and automatically injects eBPF filter programs into cgroups and network interfaces, with a built-in DNS server that resolves allowed domains and populates the IP allowlist. Netfence daemons can be...

CVE-2025-65318-and-CVE-2025-65319

PoC for CVE-2025-65318 and CVE-2025-65319 CVE-2025-65318 BDU:2025-13740: When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of bo...

dapr

driver-attack-platform Background: https://github.com/nccgroup/dapr/wiki prerequisites A relatively recent verison of nodejs tested with version v11.4.0 If targeting a linux desktop and using NVM to manage nodejs install, run these commands to allow running node as root...

CVE-2024-39929

Exim CVE-2024-39929 Exploit PoC This repository contains a Proof-of-Concept PoC script to exploit the Exim vulnerability CVE-2024-39929. The vulnerability affects Exim versions prior to 4.98, allowing attackers to bypass file extension blocking mechanisms and potentially deliver executable...

gitea-restore-file-open

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-restore-file-open Write-up: https://abraxaslabs.tech/research/gitea-restore-file-open gitea-restore-file-open Gitea 1.27.3 - Gitea CVE-2026-59765 put a hostmatcher HTTP client on OpenWithClient. The file://...