CVE-2026-72592 dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72592

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72592

CVE-2026-72592 affects dulldusk/phpfm up to version 1.8.0, where an unrestricted file upload is possible. The root cause is an empty upload extension filter and no authentication by default, enabling an unauthenticated remote attacker to upload a PHP webshell and execute it by accessing the uploa...

EUVD-2026-55214

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72583

CVE-2026-72583 affects fastschema up to v0.15.1. A stored XSS exists when uploading SVGs due to a MIME type bypass: the PutMultipart path validates the Content-Type header instead of inspecting file content, enabling an attacker (low-privileged, authenticated) to rename files to .jpg while declar...

CVE-2026-72583 fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089

The CVE-2026-19089 entry concerns the Product Input Fields for WooCommerce WordPress plugin prior to 2.0.2. The vulnerability is that the plugin does not validate uploaded file types when the accepted-types setting is empty, which the documentation claims allows all files. This permits unauthenti...

CVE-2026-16985 Squeeze < 1.7.12 - Author+ Arbitrary File Upload

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

CVE-2026-16985 – Squeeze WordPress plugin (

The vulnerability of the trx_addons plugin of the WordPress content management system allows a hacker to upload arbitrary files.

The vulnerability of the trxaddons plugin of the WordPress content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load any files remotely...

The vulnerability of the `waveplayer_create_local_copy()` function in the WavePlayer plugin of the WordPress content management system allows a hacker to upload arbitrary files and execute arbitrary code.

The vulnerability of the waveplayercreatelocalcopy function in the WordPress content management system’s plugin, WavePlayer, allows for unlimited loading of malicious files. Exploiting this vulnerability enables a remote attacker to load arbitrary files and execute arbitrary code by loading a...

The vulnerability of the NF_FU_AJAX_Controllers_Uploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin allows a attacker to execute arbitrary code.

The vulnerability of the NFFUAJAXControllersUploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin is related to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

The vulnerability of the api/store_javascript_cache.php file of the BerqWP plugin allows a hacker to execute arbitrary code.

The vulnerability of the api/storejavascriptcache.php file of the BerqWP plugin is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the imageUploadHandle() function in the WPBookit plugin, a content management system for WordPress websites, allows a hacker to execute arbitrary code.

The vulnerability of the imageUploadHandle function in the WPBookit plugin of the WordPress content management system involves unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the fetch_gravatar_from_remote() function in the Breeze Cache plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the fetchgravatarfromremote function in the Breeze Cache plugin of the WordPress content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the simple-file-list plugin in the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the simple-file-list plugin in the WordPress content management system involves unlimited loading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the `install_and_activate_plugin_from_external()` function of the GutenKit plugin – Page Builder Blocks, Patterns, and Templates for the Gutenberg Block Editor, a content management system for WordPress – allows attackers to upload arbitrary files.

The vulnerability of the installandactivatepluginfromexternal function of the GutenKit plugin – which is used for Page Builder Blocks, Patterns, and Templates in the Gutenberg Block Editor of the WordPress content management system – is related to the lack of authentication. Exploiting this...