Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution

Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...

CVE-2026-92030

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92030

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92030 Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

EUVD-2026-78493

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

CVE-2026-92030

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

PT-2026-91966

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

Astra Linux – Vulnerability in Firefox

An attacker who could have convinced a user to drag and drop an image into a file system could have manipulated the resulting filename to include an executable extension. By doing so, the attacker could potentially trick the user into executing malicious code. Although very similar, this is a...

Astra Linux – Vulnerability in Firefox

Insufficient validation in the Drag and Drop API, combined with social engineering, may have allowed an attacker to trick end-users into creating shortcuts to local system files. This could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions earlier than 115...

lab-cve-2025-3515

CVE-2025-3515 WordPress ラボ Drag and Drop Multiple File Upload for Contact Form 7 脆弱なWordPress環境を立ち上げて、CVE-2025-3515（プラグイン drag-and-drop-multiple-file-upload-contact-form-7 ≤ 1.3.8.9 の ddmuuploadfile を介した無制限のファイルアップロード）を再現・検証します。このラボはDocker化されており、Nucleiを使った迅速で確定的なテストが可能です。 脆弱なプラグイン:...

CVE-2026-18351

CVE-2026-18351 针对 CVE-2026-18351 的大规模利用工具 — Drag and Drop File Upload for Elementor Forms 致谢 johenlastgen | telegram @johenlastgen | 频道 @jlgnetworkredirect 功能特性 被动漏洞探测（不上传文件） 完整利用模式，包含 shell 上传与 RCE 确认 支持单目标和批量目标 支持多线程 可配置的命令执行 完整日志、仅漏洞、仅已攻陷输出文件 请求超时配置 环境要求 无外部依赖 — 仅使用 Python 标准库。 root@kitploit:...

WebKitGTK-DND-Fix

WebKitGTK-DND-Fix 用于在 CVE-2025-13947 之后恢复 WebKitGTK 和 WPE 上可信 文件拖放功能的研究与 CI 笔记本。 问题 CVE-2025-13947（WSA-2025-0009、GHSA-j77f-3hf7-7rvg）允许网页内容通过 WebKitGTK 上的拖放操作读取本地文件内容。上游修复（bugs.webkit.org 303434）是一次广泛的禁用：allowsFileAccess 在所有非 Cocoa 端口上返回 false，因此每次拖放时 dataTransfer.files...

EUVD-2026-75227

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

CVE-2026-73427

A flaw was found in Trix, a rich text editor. A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript...

Astra Linux – Vulnerability in Chromium

Before version 87.0.4280.141, using the "drag and drop" feature in Google Chrome on Linux allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

EUVD-2026-63821

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-18781 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-18781

CVE-2026-18781 affects the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin in versions before 1.3.9.9 . The root cause is a control character filename bypass : the plugin strips characters from uploaded filenames but does not re-validate the resulting name, allowing an unau...

CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...