CVE-2026-94619

The multi-user file manager FileGator is vulnerable to a flaw in backend/Controllers/UploadController.php prior to version 7.15.0 . The POST /upload endpoint uses a request-supplied resumableFilename as an unnamespaced key in shared temporary storage. A low-privileged user can exploit this by set...

EUVD-2026-118520

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...

WordPress MaxUpload plugin <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability discovered by JIWOONG LEE kimchunbok - Hyundai Red Team in WordPress Plugin MaxUpload versions = 1.4.0...

CVE-2026-15965 MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension an...

CVE-2026-15965 MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension an...

CVE-2026-15965: Unrestricted Upload of File with Dangerous Type

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension an...