85729 matches found
CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE
CVE-2025-69906: Caricamento Arbitrario di File a RCE in Monstra CMS 3.0.4 Autore : David PS Abraham Data : 5 febbraio 2026 Gravità : Critica - Esecuzione di Codice Remota CVSS 8.8+ CWE : 434 Caricamento senza restrizioni di un file con tipo pericoloso Descrizione della Vulnerabilità Il plugin Fil...
CVE-2026-105695
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105686
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105389
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...
CVE-2020-23591
CVE-2020-23591 OPTILINK E-PON "MODELLO N.: OP-XT71000N" con "VERSIONE HARDWARE: V2.2"; e "VERSIONE FIRMWARE: OPV3.3.1-191028" Vulnerabilità trovata in "OPTILINK OP-XT71000N Versione hardware: V2.2 , Versione firmware: OPV3.3.1-191028" che consente a un attaccante di caricare file arbitrari tramit...
CVE-2026-1405
CVE-2026-1405 Slider Future = 1.0.5 - Caricamento Arbitrario di File Non Autenticato 🚀 CVE-2026-1405.py — Strumento di Exploit di Massa per Slider Future 🩸 Panoramica della Vulnerabilità Componente: Slider Future plugin WordPress Versioni interessate: ≤ 1.0.5 Vulnerabilità: Caricamento Arbitrario...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
EUVD-2026-92714
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105695
The open-source design and prototyping platform Penpot contains a missing authorization vulnerability in its chunked-upload assembly functionality. Prior to version 2.18.0 , the assemble-chunks function retrieves an upload session using only its session ID, failing to scope the lookup to the auth...
CVE-2026-48908-Joomla-SP-Page-Builder-RCE
🛡️ Analisi di CVE-2026-48908 Caricamento Arbitrario di File non Autenticato verso RCE in JoomShaper SP Page Builder -critical?style=for-the-badge&logo=alert -black?style=for-the-badge&logo=github Una completa analisi tecnica di una vulnerabilità di esecuzione remota di codice non autenticata. 📌...
CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail
ConcreteCMS Stored XSS v.9.2.1 Autore: Sergio Descrizione: ConcreteCMS v9.2.1 è affetto da una vulnerabilità di Arbitrary File Upload che permette Cross-Site Scripting XSS memorizzato. Vettori di attacco: Una vulnerabilità nella sanificazione del caricamento di file "Thumbnail" permette di carica...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
EUVD-2026-92779
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105686
The open-source design and prototyping platform Penpot is vulnerable to temporary-storage amplification in versions prior to 2.18.0 . The issue exists within the chunked media upload RPC , which fails to reject or replace previously stored chunk indexes. An authenticated user can repeatedly uploa...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2022-3992
CVE-2022-3992 Cross-Site Scripting in WonderCMS Descrizione: Una vulnerabilità di cross-site scripting XSS in Sanitization Management System v1.0 consente a potenziali aggressori di caricare file arbitrari tramite un nome appositamente creato nei campi del logo del sistema nei campi delle...