Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Impact Ability to run arbitrary code on the server without authentication...

GHSA-G4C3-4G96-6G4M Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Impact Ability to run arbitrary code on the server without authentication...

CVE-2026-45140 Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

CVE-2026-45140

Chamilo LMS (open-source learning management system) versions prior to 2.0.1 are vulnerable to unauthenticated remote code execution via the CStudio upload flow . An attacker can execute arbitrary code on the server without prior authentication, resulting in full compromise of confidentiality, in...

CVE-2026-45140 Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

CVE-2026-45140 Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

EUVD-2026-42855

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition OCR module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding...

CVE-2026-3892

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow. The plugin allows any authenticated user to...

CVE-2026-41180

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under /files/:uploadId validates the mounted request path using the still-encoded req.path, but the downstream tus handler later writes using the decoded req.params.uploadId. In...

CVE-2026-6261

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the uploadicons function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it...

CVE-2026-3892

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow. The plugin allows any authenticated user to...

CVE-2026-6261

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the uploadicons function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it...

CVE-2026-6261

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the uploadicons function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it...

CVE-2026-41180

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under /files/:uploadId validates the mounted request path using the still-encoded req.path, but the downstream tus handler later writes using the decoded req.params.uploadId. In...

CVE-2025-34215

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 only VA deployments expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains the...

ch.artaios:openchemlib-vaadin (>=1.0.0, <=2.4.1), ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16) +185 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=24.0.0, <=24.7.6)

com.vaadin:vaadin-upload-flow MAVEN version =24.0.0, =1.0.0, =0.0.15, =1.1.5, =1.0.0, =24.3.0-alpha1, =24.4.0-beta1, =2.0.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =2.0.0-alpha1, =24.7.1 and more Source cves: CVE-2025-9467 Source advisory: GHSA-94G8-XV23-7656...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2025-9467 Source advisory:...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2025-9467 Source advisory: GHSA-94G8-XV23-7656...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by unknown CVE via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-94G8-XV23-7656...

ch.artaios:openchemlib-vaadin (>=1.0.0, <=2.4.1), ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16) +185 more potentially affected by unknown CVE via com.vaadin:vaadin-upload-flow (>=24.0.0, <=24.7.6)

com.vaadin:vaadin-upload-flow MAVEN version =24.0.0, =1.0.0, =0.0.15, =1.1.5, =1.0.0, =24.3.0-alpha1, =24.4.0-beta1, =2.0.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =2.0.0-alpha1, =24.7.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-94G8-XV23-7656...