CVE-2026-40126

OutSystems Service Center is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low-privileged attacker can exploit it by uploading a file whose filename contains malicious JavaScript code . The flaw exists in all locations within Service Center where a file can be attached and p...

CVE-2026-40126 DOM-based Cross-Site Scripting in OutSystems Service Center

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

CVE-2026-74800

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...

CVE-2026-74894 openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token

opensslencrypt before 1.4.0 contains an authentication bypass vulnerability in the verifyapitoken function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bear...

CVE-2026-74800 SiYuan before v3.7.4 Stored XSS via assets endpoint

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...

WordPress MaxUpload plugin <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability discovered by JIWOONG LEE kimchunbok - Hyundai Red Team in WordPress Plugin MaxUpload versions = 1.4.0...

CVE-2026-74845

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-74845

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-74845

CVE-2026-74845 concerns the Official Document Management System by 2100 Technology, with an Arbitrary File Upload vulnerability that enables authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. From the connected references, ...

CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

EUVD-2026-60077

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

BIT-GHOST-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

CVE-2026-67925

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

Budibase 3.31.4 Authentication Bypass / Remote Code Execution

Budibase versions through 3.31.4 contain an authentication and authorization bypass vulnerability that allows an unauthenticated remote attacker to access protected API endpoints by placing a webhook route pattern in the request query string. This proof of concept first verifies the bypass agains...

PT-2026-76595

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2026-76740

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-67678

The RainyGao-Hithub DocSys v.2.02.80 software is affected by a File Upload vulnerability that allows a remote attacker to execute arbitrary code . The vulnerability is categorized with a CRITICAL severity score of 9.8 (CVSS v3.1), indicating a high impact on confidentiality, integrity, and availa...

CVE-2026-67925

A Cross Site Scripting (XSS) vulnerability exists in JeecgBoot v.3.9.2 . A remote attacker can exploit this flaw via the /airag/chat/upload endpoint to execute arbitrary code. While the impact is described as code execution, the vulnerability is categorized as XSS. Specific information regarding ...

PT-2026-77041

Name of the Vulnerable Software and Affected Versions Sync Post With Other Site versions prior to 1.9.4 Description The Sync Post With Other Site plugin for WordPress allows authenticated attackers with contributor-level access and above to upload arbitrary files to the server. This issue occurs...