CVE-2026-56702

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702

Adminer versions prior to 5.4.3 are affected by an unrestricted file upload vulnerability in the AdminerFileUpload plugin. The root cause is a permissive default extension allowlist that allows authenticated users to upload PHP files by targeting columns ending in _path. When the uploadPath direc...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

EUVD-2026-65200

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

EUVD-2026-65164

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

PT-2026-81446

Name of the Vulnerable Software and Affected Versions Reachy Mini versions prior to 1.8.2 Description The Reachy Mini daemon exposes the '/api/media/sounds/upload' endpoint, implemented by the upload sound function, without authentication, file-extension checks, content validation, or size...

Linux Distros Unpatched Vulnerability : CVE-2026-56702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP...

CVE-2026-32559

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-32559

UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...

CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-78337

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Plugin UltimateAI versions = 3.1.0...

EUVD-2026-64825

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78245 itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function moveuploadedfile of the file allusers/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. T...

CVE-2026-78245

itsourcecode Online Pharmacy System 1.0 is affected by an unrestricted file upload vulnerability in the User Registration component. The flaw resides in the move_uploaded_file function within all_users/register.php, where manipulation of the photo argument allows a remote, unauthenticated attacke...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability

Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload was never supported by forms.FileField or forms.ImageField only the last uploaded file was validated. However, Django’...

Astra Linux – Vulnerability in Tomcat9, libcommons-fileupload-java

Apache Commons FileUpload before version 1.5 does not limit the number of request parts that can be processed, which means that an attacker could potentially trigger a Denial-of-Service attack with a malicious upload or series of uploads. It’s important to note that, like all file upload...