CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

WordPress MapSVG – Vector maps, Image maps, Google Maps plugin <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload vulnerability

Authenticated Administrator+ Arbitrary File Upload vulnerability discovered by ? in WordPress Plugin MapSVG versions = 8.14.0...

CVE-2026-61900

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-60032

Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible incl. polyglot filenames; chmod didn't strip execute bits...

CVE-2026-61424

CVE-2026-61424 affects the Joomla extension DJ-Classifieds . The connected documents describe an unauthenticated file upload vulnerability that leads to full remote code execution (RCE) . The CVE entry specifies the issue for DJ-Classifieds versions earlier than 3.11.2. This means an attacker cou...

CVE-2026-61424

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61900

Affected software: Joomla extension DJ-Extensions JDownloads (DJ-jDownloads). Vulnerability: Unauthenticated file upload leading to full RCE. Root cause / details: Reported as unauthenticated arbitrary file upload in JDownloads prior to a fixed version. The CVEs describe a critical remote code ex...

CVE-2026-61900 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6

The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61900 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61900

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-60032

Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible incl. polyglot filenames; chmod didn't strip execute bits...

CVE-2026-60032 Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0

Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible incl. polyglot filenames; chmod didn't strip execute bits...

CVE-2026-60032

The CVE concerns the Joomla extension JMedia. Vulnerable pre-1.6.0 to an authenticated arbitrary file upload that can lead to remote code execution (RCE). The underlying issue is that uploaded executables (including polyglot filenames) may retain execute permissions after upload. Impact is high: ...

EUVD-2026-46054

The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible incl. polyglot filenames; chmod didn't strip execute bits...

CVE-2026-45797

CVE-2026-45797 affects HeyForm (open-source form builder). Before version 3.0.0-rc.7, the /api/upload endpoint allowed unauthenticated file uploads, including SVGs. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express’s serve-static middle...

CVE-2026-45797 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

CVE-2026-57311 Unrestricted Upload of File with Dangerous Type in Windu CMS

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...