TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

CVE-2026-21662 FMS Employee Allows Upload of Unrestricted Files

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-21662 FMS Employee Allows Upload of Unrestricted Files

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-21662

CVE-2026-21662 describes an "Unrestricted upload of file with dangerous type" vulnerability in Johnson Controls FM Systems Employee, affecting versions before 2025.3.1. The issue involves uploading potentially dangerous files, enabling use of malicious files. The official metrics list a CVSS v4.0...

EUVD-2026-51588

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-21662

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2026-24727

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727

The CVE-2026-24727 entry describes an unrestricted file upload vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System (v10.3). An authenticated administrator can upload a crafted ZIP archive containing a server-executable file to achieve remote code exec...

CVE-2026-16451

A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulation of the argument File results in...

CVE-2026-16451 zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload

A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulation of the argument File results in...

CVE-2026-16451

CVE-2026-16451 concerns zsadmin2025 ZS-Admin (up to commit b52e14536d59fda11e56e2536a1c32e82a38cead). The vulnerability is in the file upload function of the component com.zs.file.controller.SysFileController, specifically the /api/system/file/upload endpoint. A manipulation of the File argument ...

CVE-2026-16447

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multiuploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-16447 D-Link DNS-320 multi_uploadify.php unrestricted upload

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multiuploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

EUVD-2026-46258

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multiuploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-16447

CVE-2026-16447 concerns a vulnerability in the D-Link DNS-320 1.0.2 where the argument Filedata[] in /web/jquery/uploader/multi_uploadify.php can be manipulated to achieve unrestricted upload. Remote exploitation is possible according to the provided records. The affected component is a server-si...

CVE-2026-16332 D-Link DNS-320 multi_uploadify.php unrestricted upload

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...

CVE-2026-16332

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...