CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-75327

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...

CVE-2026-77368: Authorization Bypass Through User-Controlled Key

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

CVE-2026-75331: Unrestricted Upload of File with Dangerous Type

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-75327: Unrestricted Upload of File with Dangerous Type

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...

CVE-2025-61165: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2026-32639: Authentication Bypass by Alternate Name

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-18080: Unrestricted Upload of File with Dangerous Type

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

CVE-2026-80237: Unrestricted Upload of File with Dangerous Type

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-80235: Unrestricted Upload of File with Dangerous Type

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-80233: Unrestricted Upload of File with Dangerous Type

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...

EUVD-2025-210784

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

PT-2026-82239

An arbitrary file upload vulnerability in the /v1/my drive/batch upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2026-75331

The software tamguo version 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS . The root cause is a lack of file type validation in the /uploadFile and /imgUpload endpoints, specifically within the FileUploadController.java and UEditorController.java components. This allows at...

PT-2026-81981

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-75327

The DocSys-master V2.02.85 application contains an arbitrary file upload vulnerability within the uploadMarkdownPic interface located at src/com/DocSystem/controller/DocController.java. This flaw allows an unauthenticated network attacker to upload files of dangerous types, potentially leading to...

PT-2026-82081

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save attachments function. This is due to missing file extension validation and missing path normalization wh...

PT-2026-82263

Name of the Vulnerable Software and Affected Versions DocSys-master version 2.02.85 Description An arbitrary file upload issue exists in the 'uploadMarkdownPic' interface within the src/com/DocSystem/controller/DocController.java file. This allows an attacker to upload unauthorized files to the...

PT-2026-82321

Name of the Vulnerable Software and Affected Versions tamguo version 1.5.3 Description An unrestricted file upload issue allows for stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on the target server. The '/uploadFile' and '/imgUpload' endpoints within...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...