PT-2026-89017

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-26212: Unrestricted Upload of File with Dangerous Type

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

CVE-2026-87928: Unrestricted Upload of File with Dangerous Type

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

PT-2026-88878

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

PT-2026-89108

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions 0.94 through 109.6 Description A stored cross-site scripting issue exists in the admin page upload handler. This flaw allows any authenticated user to upload HTML files containing malicious scripts to the uploads/ pages/...

CVE-2026-75307

The software zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) . The flaw exists in the SVG file upload functionality accessible via the /equipmentFile/upload endpoint. This vulnerability allows for the execution of malicious scripts in a user's browser. While the vulnerability is docu...

PT-2026-89043

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Broken access control exists in the AssetModelPolicy where the files method incorrectly cascades from the assets.files permission. This allows authenticated users to upload and delete file attachmen...

WordPress Rara One Click Demo Import plugin <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by Rinesa Krasniqi in WordPress Plugin Rara One Click Demo Import versions = 1.3.4...

PT-2026-89165

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

CVE-2026-75307

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

CVE-2026-75308

yshopmall =3.3 is vulnerable to Cross Site Scripting XSS. The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files...

PT-2026-89018

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An issue exists where the application fails to verify the return value of storage write operations within the ImageUploadRequest::handleImages function. Due to the default disk mode of the Laravel...

PT-2026-89254

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous...

Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous...

GHSA-QVFW-J98X-7Q72 multer vulnerable to file size limit bypass via async fileFilter race condition

Impact When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accept...

multer vulnerable to file size limit bypass via async fileFilter race condition

Impact When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accept...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

CVE-2026-78741

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

EUVD-2026-73942

A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger th...

CVE-2026-54611

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...