CVE-2026-126380

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary ...

CVE-2026-126380 Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary ...

EUVD-2026-125185

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary ...

CVE-2026-126380 Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary ...

CVE-2026-126380

Vvveb versions before 1.0.9.0 are vulnerable to Remote Code Execution (RCE) due to a denylist bypass in system/traits/media.php. The vulnerability occurs because the .phar extension is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files . Attackers ca...

CVE-2026-117127

Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the actionserve function in media.php...

CVE-2026-117127: n/a: Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information…

Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the actionserve function in media.php...

CVE-2026-117127

A Directory Traversal vulnerability exists in Gleez Technologies' Gleez CMS v.1.2.0 . The flaw is located in the action_serve function within the media.php file, which could allow a remote attacker to obtain sensitive information . While a sighting of this vulnerability was recorded on October 31...

EUVD-2026-115381

Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the actionserve function in media.php...

CVE-2026-117127

Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the actionserve function in media.php...

PT-2026-135639

Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the action serve function in media.php...

CVE-2026-117127

Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the actionserve function in media.php...

CVE-2026-36469

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery SSRF in core/modules/media.php -- uploadfrominet Media Manager's "Upload by URL" functionality...

CVE-2026-36467

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-36467

The CuteNews v.2.1.2 application is vulnerable to an Unrestricted Upload of File with Dangerous Type within the core/modules/media.php component. This flaw allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application. Suc...

EUVD-2026-83989

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-36467

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-36467: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-36469

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery SSRF in core/modules/media.php -- uploadfrominet Media Manager's "Upload by URL" functionality...

CVE-2026-36469: Server-Side Request Forgery (SSRF)

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery SSRF in core/modules/media.php -- uploadfrominet Media Manager's "Upload by URL" functionality...