CVE-2025-26260

Plenti = 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution...

GO-2025-3454 Plenti - Code Injection - Denial of Services in github.com/plentico/plenti

Plenti - Code Injection - Denial of Services in github.com/plentico/plenti...

PT-2024-33494 · Plenti +1 · Plenti +1

Name of the Vulnerable Software and Affected Versions: Plenti versions prior to 0.7.2 Description: The issue is related to an arbitrary file write vulnerability. The /postLocal endpoint is vulnerable, which may lead to Remote Code Execution when a Plenti user serves their website. Recommendations...