CVE-2026-75873: Unrestricted Upload of File with Dangerous Type

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution...

CVE-2021-24491

The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack...

CVE-2015-4673

Multiple cross-site scripting XSS vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via 1 the collectiondescription parameter to upload/managecollections.php in an addnew action or the 2 photodescription, 3 phototags, or 4 phototitle...

PT-2017-6782

Name of the Vulnerable Software and Affected Versions ClipBucket version 2.7.0.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The injection can occur via specific...