CVE-2025-58440

CVE-2025-58440 Remote Code Execution RCE via Polyglot File Attack and Null Byte Injection on Laravel FileManager Overview The unisharp/laravel-filemanager package versions 2.11 are vulnerable to Remote Code Execution RCE due to improper file type validation during file uploads. The vulnerability...

EUVD-2026-75959

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-74992

The Kirki WordPress plugin (versions before 6.2.3 ) contains a vulnerability where it fails to properly validate files within archives uploaded by users with the Editor role. Additionally, the plugin does not remove all unwanted files after extraction. This allows authorized users to upload arbit...

CVE-2026-74902: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

GHSA-QHR7-V3XP-VW9M Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...

CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

EUVD-2026-53115

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

PT-2026-67666

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16060

The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code executi...

CVE-2026-13157

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

Arbitrary File Upload

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to Arbitrary File Upload via the isimage or mimein upload validation rules. An attacker can execute arbitrary code by uploading a file with...

CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

PT-2026-61589

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-48062

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

PYSEC-2026-1499 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed...

Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

ImpactKiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introducedchanges which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed...

PYSEC-2026-1500 kiwitcms vulnerable to stored XSS via unrestricted files upload

Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded, see GHSA-fwcf-753v-fgcj and Content-Security-Policy definition to prevent...

kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload

ImpactKiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The...