PT-2026-68173

Name of the Vulnerable Software and Affected Versions wiseCampaign – WooCommerce Conversions Made Easy versions prior to 1.1.17 Description The plugin is susceptible to unauthorized data disclosure and modification because all REST API endpoints are registered with permission callback = ' return...

PT-2026-68311

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A path traversal issue allows an unauthenticated attacker with network reachability to delete arbitrary files and directories on the instance, including the user storage directory...

📄 ICS-Park Smart Park Management System 2.0 Cross Site Scripting

A proof of concept exploit for a cross site scripting vulnerability in ICS-Park Smart Park Management System version 2.0. An authenticated user can upload arbitrary HTML files because the upload whitelist permits .html and .htm extensions, resulting in stored cross site scripting when another use...

PT-2026-67969

Name of the Vulnerable Software and Affected Versions zportals WordPress plugin versions prior to 6.3.4 Description The plugin fails to properly validate uploaded files by trusting the client-supplied content type and preserving the original file extension. This allows any authenticated user with...

CVE-2026-16583: Improper Neutralization of Input During Web Page Generation

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

PT-2026-68361

Name of the Vulnerable Software and Affected Versions Rongzhitong Visual Integrated Command and Dispatch Platform versions prior to 20260617 Description An unrestricted upload issue exists in the /dm/dispatch/userinfo/upload endpoint. By manipulating the File argument, a remote attacker can uploa...

py-djangorestframework -- two vulnerabilities

Bruno Alla reports: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data AdminRenderer may disclose GET-protected data when rendering invalid write requests...

VulnCheck KEV: CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

NPM: Ghost: Theme Upload Path Traversal

NPM: Ghost: Theme Upload Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

Directory Traversal

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Directory Traversal through the theme upload validation in services/themes/storage.js and LocalStorageBase.ts. An attacker can write files outside the uploads directory by uploading a custom theme with a...

CVE-2026-70593

CVE-2026-70593 affects Ghost (Node.js) versions 0.10.0–6.54.1. A vulnerability in custom themes allows a staff user to write files outside the uploads directory via path traversal in LocalStorageBase and theme storage name handling, enabling modification of installation behavior. The issue is fix...

CVE-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

Malicious code in nagix-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279 package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines in index.js. The first...

MAL-2026-11525 Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...

Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...

EUVD-2026-39021

Ghost: File Upload Content-Type Spoofing...

GHSA-944X-PM95-3JPR Ghost: File Upload Content-Type Spoofing

Impact Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the...

NPM: Ghost: File Upload Content-Type Spoofing

NPM: Ghost: File Upload Content-Type Spoofing vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-15307 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-15307 via django (2.2.7)

django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...