CVE-2026-19383

This CVE affects saithink/saigroup SaiAdmin (up to version 5.0.1). The vulnerability lies in the shell_exec usage within /app/saipackage/install/upload of the Plugin Upload Endpoint, enabling unrestricted file upload. The issue is exploited remotely and publicly disclosed; exploit code/methods ar...

CVE-2026-19383 saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

EUVD-2026-54959

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

The vulnerability of the trx_addons plugin of the WordPress content management system allows a hacker to upload arbitrary files.

The vulnerability of the trxaddons plugin of the WordPress content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load any files remotely...

The vulnerability of the NF_FU_AJAX_Controllers_Uploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin allows a attacker to execute arbitrary code.

The vulnerability of the NFFUAJAXControllersUploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin is related to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

The vulnerability of the api/store_javascript_cache.php file of the BerqWP plugin allows a hacker to execute arbitrary code.

The vulnerability of the api/storejavascriptcache.php file of the BerqWP plugin is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the `waveplayer_create_local_copy()` function in the WavePlayer plugin of the WordPress content management system allows a hacker to upload arbitrary files and execute arbitrary code.

The vulnerability of the waveplayercreatelocalcopy function in the WordPress content management system’s plugin, WavePlayer, allows for unlimited loading of malicious files. Exploiting this vulnerability enables a remote attacker to load arbitrary files and execute arbitrary code by loading a...

📄 WordPress 7.0.2 Code Execution / Cross Site Scripting

A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...

The vulnerability of the simple-file-list plugin in the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the simple-file-list plugin in the WordPress content management system involves unlimited loading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the imageUploadHandle() function in the WPBookit plugin, a content management system for WordPress websites, allows a hacker to execute arbitrary code.

The vulnerability of the imageUploadHandle function in the WPBookit plugin of the WordPress content management system involves unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the fetch_gravatar_from_remote() function in the Breeze Cache plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the fetchgravatarfromremote function in the Breeze Cache plugin of the WordPress content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the `install_and_activate_plugin_from_external()` function of the GutenKit plugin – Page Builder Blocks, Patterns, and Templates for the Gutenberg Block Editor, a content management system for WordPress – allows attackers to upload arbitrary files.

The vulnerability of the installandactivatepluginfromexternal function of the GutenKit plugin – which is used for Page Builder Blocks, Patterns, and Templates in the Gutenberg Block Editor of the WordPress content management system – is related to the lack of authentication. Exploiting this...

CVE-2026-19372

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19372 Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversal

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19372

The CVE-2026-19372 entry concerns Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. The vulnerability affects the upload_document component, specifically the function fs.readFileSync in src/index.ts, where manipulating the File argument can trigger path traversal. Local access is required. Both t...

CVE-2026-17044

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

EUVD-2026-54894

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-17044

CVE-2026-17044 affects the Iptanus File Upload WordPress plugin prior to 5.1.8. The issue is an SQL injection caused by improper sanitisation/escaping of a parameter used in a SQL statement, exploitable by unauthenticated users. Base score 8.6 (HIGH); remediation is to upgrade to 5.1.8 or later. ...

CVE-2026-17044 WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

VulnCheck KEV: CVE-2026-55450

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the...