CVE-2026-67206: Unrestricted Upload of File with Dangerous Type

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

CVE-2026-23768

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension...

Lucy-XSS security vulnerability

Lucy-XSS is an open-source cross-site scripting protection library developed by NAVER. Lucy-XSS has a security vulnerability that occurs when the ObjectSecurityListener or EmbedSecurityListener option is enabled, and the src attribute lacks a file extension. This vulnerability may lead to a HEAD...

CVE-2023-4300: Undefined Security Weakness

The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution...