CVE-2026-9157 Remote Code Execution in Gmission Web FAX

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1...

EUVD-2026-31244

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1...

PT-2026-42844

Name of the Vulnerable Software and Affected Versions Azure Orbital Spatio affected versions not specified Description Unrestricted upload of files with dangerous types allows an unauthorized attacker to execute code over a network. This issue enables unauthenticated Remote Code Execution RCE,...

PT-2026-42651

Summary The copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto , constructor, prototype. This allows an attacker to pollute the prototype chain of all objects in the...

PT-2026-42701

Name of the Vulnerable Software and Affected Versions @nevware21/ts-utils versions prior to 0.14.0 Description The copyProps function in lib/src/object/copy.ts iterates over source object properties using a for...in loop without performing an Object.hasOwnProperty check. Additionally, it fails to...

PT-2026-42443

Name of the Vulnerable Software and Affected Versions Gmission Web Fax versions 3.0 through 3.0 Description Improper input validation and unrestricted upload of files with dangerous types allow Remote Code Inclusion, a process where an attacker can force the application to execute code from a...

CVE-2026-45444

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6...

EUVD-2026-31149

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6...

CVE-2026-45444

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6...

PT-2026-42226

Name of the Vulnerable Software and Affected Versions Gift Cards For WooCommerce Pro versions prior to 4.2.7 Description An unrestricted file upload issue allows the use of malicious files with dangerous types. This flaw has been confirmed to be exploited in the wild. Recommendations Update to a...

wordpress plugin Gift Cards For WooCommerce Pro 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Exposed Dangerous Method or Function

Overview @penpot/mcp is a MCP server for Penpot integration Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via MCP module's ReplServer that binds to all interfaces 0.0.0.0:4403 and exposes a /execute endpoint that runs arbitrary code with zero...

NPM: Budibase: Unrestricted Upload of File with Dangerous Type

NPM: Budibase: Unrestricted Upload of File with Dangerous Type vulnerability discovered by ? in WordPress Npm budibase versions 3.38.2...

Arbitrary File Upload

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Arbitrary File Upload via file upload endpoint POST /api/attachments/process that does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions...

Budibase: Unrestricted Upload of File with Dangerous Type

Summary The file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions html, svg, js, php, etc. are conditionally wrapped inside if isPublicUser or if isPublicUser || !env.SELFHOSTED, meaning an...

GHSA-82RC-GXRG-V4GF Budibase: Unrestricted Upload of File with Dangerous Type

Summary The file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions html, svg, js, php, etc. are conditionally wrapped inside if isPublicUser or if isPublicUser || !env.SELFHOSTED, meaning an...

Exposed Dangerous Method or Function

Overview @nuxt/webpack-builder is a Webpack bundler for Nuxt Affected versions of this package are vulnerable to Exposed Dangerous Method or Function when using webpack or rspack builder and navigating to a malicious website. An attacker can inject a script tag to request a classic script, which ...

CVE-2026-4883 Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetformsajaxformbuilder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, a...

CVE-2026-39250

An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations...

PT-2026-42050

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.38.2 Description The file upload endpoint "/api/attachments/process" does not enforce active-content restrictions for authenticated users. The system fails to properly check for dangerous file extensions when the...