EUVD-2026-50296

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

PT-2026-65784

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...

CVE-2026-60025

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

EUVD-2026-45198

The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

CVE-2026-60025

The Joomla extension Events Booking (prior version 5.8.0) by joomdonation.com is vulnerable to User enumeration because a frontend file upload endpoint lacks CSRF protection . This security flaw could allow an attacker to interact with the upload endpoint without proper authorization. No specific...

PT-2026-60787

Name of the Vulnerable Software and Affected Versions Events Booking versions prior to 5.8.0 Description The Joomla extension contains a frontend file upload endpoint that lacks Cross-Site Request Forgery CSRF protection. CSRF is a type of attack that tricks a victim into submitting a malicious...

CVE-2026-9067

The Schema & Structured Data for WP & AMP WordPress plugin (versions

EUVD-2026-35988

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any fil...

CVE-2026-9067 Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any fil...

CVE-2026-7733 funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload

A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to ...

FunAdmin 访问控制错误漏洞

FunAdmin is an open-source backend development system developed using ThinkPHP6 and Layui. Versions of FunAdmin 7.1.0-rc6 and earlier contain an access control vulnerability. This vulnerability stems from the UploadService::chunkUpload function in the Frontend Chunked Upload Endpoint, where the...

Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby

Impact An editor with write access to the Kirby Panel can upload an SVG or XML file that contains harmful content like tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to Kirby, the script wi...

TPshop open source mall file upload vulnerabilities exist in the foreground

TPshop open source mall is developed with the latest version of ThinkPHP shop mall. TPshop open source mall front-end file upload vulnerability. Allow attackers to upload webshell, get server privileges...

Wordpress Frontend Upload插件任意文件上传漏洞

No description provided by source. Exploit Title: Frontend Upload Wordpress Plugin - File Arbitrary Upload Date: 10/02/2014 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Frontend Upload...

WordPress Plugin Frontend Upload - Arbitrary File Upload

Exploit Title: Frontend Upload Wordpress Plugin - File Arbitrary Upload Date: 10/02/2014 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Frontend Upload...

WordPress Frontend Upload Plugin - Arbitrary File Upload

Frontend Upload plugin is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Upgrade the plugin...

WordPress Plugin Frontend Upload - Arbitrary File Upload

WordPress Plugin Frontend Upload - Arbitrary File Upload Exploit Title: Frontend Upload Wordpress Plugin - File Arbitrary Upload Date: 10/02/2014 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Frontend Upload...

Wordpress Frontend Upload Plugin - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Frontend Upload Wordpress Plugin - File Arbitrary Upload Date: 10/02/2014 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Frontend Upload...