4343 matches found
gophish
Gophish fork This is a fork of Gophish: Open-Source Phishing Toolkit Gophish New features This fork has a focus on running real-life phishing campaigns for a single customer. The following features are added: Script to automatically setup a fully configured Gophish instance on a fresh VPS. This...
CVE-2026-110774
The Blinko application (versions through 1.8.8 ) is vulnerable to a broken access control flaw in the /api/file route. This vulnerability arises from a flawed owner check , allowing authenticated users to bypass authorization and read private attachments belonging to other users. An attacker can ...
CVE-2026-76519
A vulnerability exists in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway . When the file reputation service is enabled, the system improperly handles email attachments, potentially allowing an unauthenticated, remote attacker to write arbitrary files to the underlying...
CVE-2026-106646
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...
EUVD-2026-100885
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...
CVE-2026-106646 Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...
PT-2026-113664
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...
CVE-2025-57231
CVE-2025-57231 - Docmost 0.22.0 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2025-57231. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permission to tes...
CVE-2026-110101
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...
CVE-2026-109957
Versions of EspoCRM prior to 10.0.7 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. This vulnerability exists in the Import endpoint , where authenticated users with Import scope access can read attachments belonging to other users by providing a foreign attachmentId . An attac...
CVE-2026-109290
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...
EUVD-2026-97592
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...
CVE-2026-109168
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and...
CVE-2026-109168
The lamp-cloud software (versions through 5.10.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). This flaw allows authenticated users to access file attachments belonging to other business objects by providing an arbitrary bizId to the listFileByBizId endpoint. Impa...
EUVD-2026-97374
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and...
CVE-2026-109168 lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and...
CVE-2026-109166
Versions of lamp-cloud through 5.10.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). The root cause is located in the FileAnyoneController 's findUrlById handler, which fails to perform ownership verification. This allows authenticated users to retrieve acce...
CVE-2026-109166 lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which...
EUVD-2026-97372
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which...
CVE-2024-9756
🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756 📌 Overview This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to...