CVE-2026-105123

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123: Unrestricted Upload of File with Dangerous Type

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

Exploit for Argument Injection in Thecodingmachine Gotenberg

🔥 GOTENBERG RCE CHAIN CVE-2026-42589 + CVE-2026-40281 !...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

CVE-2026-105115

OpenAM versions prior to 16.1.3 are vulnerable to an unauthenticated arbitrary class instantiation vulnerability within the legacy JAX-RPC SOAP interface . Remote attackers can exploit this by sending SOAP requests to the */jaxrpc/ endpoint using an unverified session identifier and a specified c...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

Dutch Institute for Vulnerability Disclosure Breached via Zammad 0-Days

Dutch Institute for Vulnerability Disclosure was breached through two Zammad 0-days in an AI-powered attack that led to remote code execution and root access...

CVE-2026-87115

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

EUVD-2026-91958

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2026-87115 VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2026-87115 VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2026-87115

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 1.2.21 . The root cause is insufficient file path validation within the extract function, specifically involving the old_vapcfN parameter...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

EUVD-2026-91937

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to an authenticated arbitrary file write via path traversal. The flaw exists because the plugin fails to sanitize file paths within uploaded archives before extraction. This allows authenticated users wi...