research-cve-2025-68971

CVE 2025-68971 | Holloway Chew, Kean Ho's Knowledge Research On 2025-12-22, a security vulnerability CVE 2025-68971 CVSS: 5.5/MEDIUM was discovered in open-source Forgejo 13.0.3 application first detected on FreeBSD14 operating system. It caused the operating system went into mass-killing all...

CVE-2026-54630 Part-DB: Authenticated RCE via .phar attachment upload served from public/media

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar...

CVE-2026-54630 Part-DB: Authenticated RCE via .phar attachment upload served from public/media

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar...

CVE-2026-54630

The Part-DB open source inventory management system is vulnerable to Remote Code Execution (RCE) in versions prior to 2.12.1 . The vulnerability exists because the AttachmentSubmitHandler::renameBlacklistedExtensions() function fails to include the .phar extension in its blocklist, allowing attac...

CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-111353 Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...

CVE-2026-111353 Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...

WordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin Photo Engine versions = 6.5.6...

CVE-2026-107801 Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share i...

CVE-2026-107801 Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share i...

CVE-2026-107801

Jivejdon versions through 5.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the application's handling of attacker-supplied Content-Type headers during attachment uploads. An authenticated attacker can upload a file declared as text/html , which the UploadShowActio...

CVE-2026-105099

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The...

CVE-2026-105099 Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The...

CVE-2026-105099 Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The...

CVE-2026-105099

A cross-site scripting (XSS) vulnerability exists in the Ticket Attachment Upload component of Omega Solution CoinEx Crypto 2025 . The flaw originates from an unknown functionality within the /user/ticket file, allowing for remote manipulation. While the product website is no longer active and th...

EUVD-2026-92070

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The...

PT-2026-104604

Name of the Vulnerable Software and Affected Versions Omega Solution CoinEx Crypto 2025 affected versions not specified Description A weakness in the Ticket Attachment Upload component allows for remote cross-site scripting XSS, a technique where malicious scripts are injected into trusted...

CVE-2026-105099: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The...

PYSEC-2026-4101 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

Summary MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the M...

CVE-2026-101071

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...