CVE-2026-110468

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/savephoto.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the...