CVE-2026-103521

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

CVE-2026-103521

In Thelia v2.6.0 , a vulnerability exists in the document update endpoint because it fails to perform the same validation as the document upload endpoint. While the upload endpoint blocks executable file types, the update endpoint allows an attacker with administrative permissions to upload arbit...

WordPress plugin MDJM Event Management has code-related vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

CVE-2026-4809

Brand-new CVE entry CVE-2026-4809 affects plank/laravel-mediable up to version 6.4.0. In vulnerable configurations that accept a client-supplied MIME type during file upload, an attacker can submit a file containing executable PHP code while declaring a benign image MIME type, enabling arbitrary ...

CVE-2026-32989

Precurio Intranet Portal 4.4 is affected by a CSRF weakness that can coerce an authenticated user into submitting a crafted request to a profile update endpoint handling file uploads. If attacker-controlled content is stored as an executable server-side file in a web-accessible location, this may...

CVE-2020-12846

Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files exe,sh,bat,jar in the Contact section of the mailbox as an avatar image for ...

EUVD-2009-0605

Malware in sbrugna...

EUVD-2008-5648

Malware in sbrugna...

EUVD-2014-2642

Malware in sbrugna...

EUVD-2008-3171

Malware in sbrugna...

EUVD-2008-3578

Malware in sbrugna...

EUVD-2004-2690

Malware in sbrugna...

EUVD-2008-6729

Malware in sbrugna...

EUVD-2010-1018

Malware in sbrugna...

EUVD-2008-6639

Malware in sbrugna...

EUVD-2011-4977

Malware in sbrugna...

EUVD-2020-5635

Malware in sbrugna...

EUVD-2007-1633

Malware in sbrugna...

EUVD-2008-6622

Malware in sbrugna...

CVE-2021-32759

OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for...