CVE-2026-30276

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

CVE-2026-30309

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerShell such as powershell, and the matching algorithm...

CVE-2026-30283

An arbitrary file overwrite vulnerability in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

Squareapps My Location Travel Timeline 安全漏洞

Squareapps My Location Travel Timeline is a map-based application developed by Squareapps that records users’ travel trajectories and generates travel timelines. Version 11.80 of Squareapps My Location Travel Timeline contains a security vulnerability. This vulnerability stems from an issue with...

CVE-2026-30276

The CVE-2026-30276 entry concerns DeftPDF Document Translator v54.0. The vulnerability is an arbitrary file overwrite during the file import process, enabling attackers to overwrite critical internal files. The resulting impact is described as arbitrary code execution or information exposure. The...

CVE-2026-30281

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

CVE-2026-30281

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

CVE-2026-30280

An arbitrary file overwrite vulnerability in RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos v1.0.135 allows attackers to overwrite critical internal files via the file import process, leading to arbtrary code execution or information exposure...

CVE-2026-30283

CVE-2026-30283 affects PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3.0. The issue is an arbitrary file overwrite via the file import process, enabling overwrite of critical internal files and potentially leading to arbitrary code execution or information exposure. The available documents co...

PT-2026-29283

Name of the Vulnerable Software and Affected Versions DeftPDF Document Translator version 54.0 Description A flaw exists in DeftPDF Document Translator v54.0 that allows attackers to overwrite critical internal files through the file import process. This can lead to arbitrary code execution or...

CVE-2026-30278

An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

Rareprob Video player 安全漏洞

Rareprob Video Player is a mobile video player application developed by the Indian company Rareprob. It supports playback of videos in multiple formats and local media management. Version 1.0.135 of Rareprob Video Player contains a security vulnerability. This vulnerability stems from an issue...

CVE-2026-30286

An arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

CVE-2026-30281

CVE-2026-30281 affects MaruNuri LLC v2.0.23, with an arbitrary file overwrite through the file import process that can lead to arbitrary code execution or information exposure. The vulnerability is tied to the file-import flow (v2.0.23). Some sources describe exploitation as remote code execution...

CVE-2026-32750 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their...

Basecamp: DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover

A DOM XSS vulnerability was discovered in the file import functionality of the Fizzy application. The vulnerability allowed an attacker to craft a malicious filename that, when previewed by the victim user, would inject a second form submission into the import page. This enabled the attacker to...

CVE-2026-32251

Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources .xml and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files...

Siemens SIMATIC S7-1500 Device Stored Cross-Site Scripting Vulnerability

SIMATIC S7-1500 is an industrial controller from Siemens. A stored cross-site scripting vulnerability exists in the Siemens SIMATIC S7-1500, which can be exploited by an attacker to inject code by tricking a legitimate user into importing a specially crafted trace file in a web interface...

EUVD-2026-9007

IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on the system. Arbitrary code may be executed when some crafted file is imported by a user with the administrative privilege...

CVE-2026-27776

IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on the system. Arbitrary code may be executed when some crafted file is imported by a user with the administrative privilege...