85884 matches found
CVE-2026-105868 Payload: Uploaded XML files could execute same-origin JavaScript
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user...
CVE-2026-105861
The headless content management system Payload is vulnerable in versions after 3.0.0 and before 3.90.0 . The flaw resides in the authenticated external URL-based upload retrieval feature, where the system fails to verify the trustworthiness of a redirected destination. This origin validation erro...
CVE-2026-105861 Payload external upload trust validation issue
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...
CVE-2026-105861 Payload external upload trust validation issue
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...
CVE-2026-105798
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...
CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...
EUVD-2026-93427
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...
CVE-2026-39770
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
CVE-2026-39755
Subscriber Arbitrary File Upload in WP Duplicate = 1.1.11 versions...
CVE-2026-39759
Employer / Sales Representative Arbitrary File Upload in Workreap Core = 3.4.5 versions...
CVE-2026-39757
Subscriber Arbitrary File Upload in Taskbot = 6.6 versions...
CVE-2026-32579
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress = 2.4.9 versions...
EUVD-2026-93277
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
CVE-2026-39770 WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
CVE-2026-39770 WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
CVE-2026-39770
The Doctreat WordPress theme, version 1.7.0 and below , is vulnerable to an unauthenticated arbitrary file upload (CWE-434). This vulnerability allows an attacker to upload files with dangerous types to the server. The impact is rated as CRITICAL (CVSS 3.1 score of 10.0), potentially leading to h...
CVE-2026-39759 WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability
Employer / Sales Representative Arbitrary File Upload in Workreap Core = 3.4.5 versions...
CVE-2026-39759 WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability
Employer / Sales Representative Arbitrary File Upload in Workreap Core = 3.4.5 versions...