EUVD-2026-55014

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-17019

The JetEngine WordPress plugin (versions prior to 3.8.13.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize uploaded SVG files before they are stored and served, combined with inadequate restrictions on who can perform uploads. This allows unauthent...

CVE-2026-17019 JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...

CVE-2026-19383

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

Exploit for CVE-2026-53787

CVE-2026-53787 - Amasty Order Attributes Unauthenticated File...

CVE-2026-19383

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19383

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19383 saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19383 saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

EUVD-2026-54982

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19383

This CVE affects saithink/saigroup SaiAdmin (up to version 5.0.1). The vulnerability lies in the shell_exec usage within /app/saipackage/install/upload of the Plugin Upload Endpoint, enabling unrestricted file upload. The issue is exploited remotely and publicly disclosed; exploit code/methods ar...

EUVD-2026-54959

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

Exploit Title: Joomla 2.9.99.4 -Unauthenticated Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Jooml...

CVE-2026-72583: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-17019: Improper Neutralization of Input During Web Page Generation

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...

CVE-2026-16985: Unrestricted Upload of File with Dangerous Type

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-19383: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

PT-2026-69478

Name of the Vulnerable Software and Affected Versions lobehub/lobe-chat versions prior to 2.2.14 Description A stored cross-site scripting XSS issue exists where a low-privileged authenticated user can inject arbitrary JavaScript into the application. This occurs because the avatar upload handler...

PT-2026-69355

Name of the Vulnerable Software and Affected Versions Squeeze WordPress plugin versions prior to 1.7.12 Description Insufficient validation of file types or extensions during attachment-update actions allows users with the upload files capability, such as those with Author privileges and above, t...

PT-2026-69852

Name of the Vulnerable Software and Affected Versions OpenCart version 4.2.0.0 Description The extension installer fails to validate that extracted paths from uploaded .ocmod.zip files remain within the intended directory. This allows an attacker to use directory traversal sequences, such as ../,...