CVE-2026-86437: Incorrect Authorization

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

PT-2026-86784

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted...

CVE-2026-86272: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch...

PT-2026-86920

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

Gravity Forms Plugin Arbitrary File Upload Code Execution

The vulnerability of the copypostimage function in the Gravity Forms plugin of the WordPress content management system is related to the ability to upload unlimited dangerous files. Exploiting this vulnerability allows a malicious actor to upload any files and execute any code...

Linux Distros Unpatched Vulnerability : CVE-2026-53769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks...

CVE-2026-86436: Missing Authorization

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...

PT-2026-86669

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

🔴 CVE-2025-31324 — SAP NetWeaver Visual Composer Unauthenticat...

Exploit for CVE-2026-44402

CVE-2026-44402 — Voltronic Power SNMP Web Pro 1.1 Unauthentica...

MAL-2026-15984 Malicious code in gas-price-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f8f9689168acafb514d0ab0bb8710f1fce42e95560a2a0c7e0e6788e913e729 Package advertises itself as a public-RPC gas price checker but on first call to the exported getGasPrice API in src/envcheck.cjs it walks the caller...

CVE-POC

SecNeural // CVE PoC Collection Authorized, defensive vulnera...

Exploit for Unrestricted Upload of File with Dangerous Type in Joomlack Page_Builder_Ck

No d...

Exploit for CVE-2026-75865

CVE-2026-75865 Proof-of-concept and technical write-up for...

Exploit for CVE-2026-32475

CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary F...

Exploit for CVE-2026-32475

CVE-2026-32475 — Elementor Pro Forms unauthenticated arbitrary...

SUSE CVE-2026-34031

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to...

SUSE CVE-2026-39904

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate function in models/attachment.go processes Office documents as ZI...

EUVD-2026-71796

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...