85842 matches found
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105686
The open-source design and prototyping platform Penpot is vulnerable to temporary-storage amplification in versions prior to 2.18.0 . The issue exists within the chunked media upload RPC , which fails to reject or replace previously stored chunk indexes. An authenticated user can repeatedly uploa...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
EUVD-2026-92779
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...
CVE-2026-105389 feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...
EUVD-2026-92774
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...
CVE-2026-105389
The feelec-yishu feelcrm-os version 1.0.0 is vulnerable to an unrestricted upload vulnerability within the UploadTicketFile Endpoint . The issue stems from unknown processing in the file App/Feelcrm/Crm/Controller/UploadController.class.php , where manipulation of the cmd argument allows for remo...
CVE-2026-105389 feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...
Node.js-CVE-2024-39943
Node.js HFS Command Execution Vulnerability CVE-2024-39943 White Hat School 3rd – Jeongmin Noh @JenmrR Summary In a Node.js-based HFS server environment, there is a vulnerability where the content of an uploaded file is executed via childprocess.execSync. An attacker can directly execute OS...
CVE-2026-102777
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...
WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Theme Doctreat versions = 1.7.0...
CVE-2026-88396
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and moveuploadedfile drops the file into the web-accessible directory...
CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...
CVE-2026-102777
The Joomla Extension - svenbluege.de Event Gallery extension (versions
CVE-2026-4040-Race-Condition-in-File-Upload-Leading-to-RCE
CVE-2026-4040 – Race Condition in File Upload Leading to RCE Program Code Python Flask uploadserver.py - File upload with race condition from flask import Flask, request import os, tempfile, time, threading app = Flaskname UPLOADDIR = '/tmp/uploads' os.makedirsUPLOADDIR, existok=True...
Exploit for CVE-2026-105314
Papermerge-core: Authenticated Path Traversal to Arbitrary Fil...
WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Aurélien BOURDOIS Elymaro in WordPress Plugin WP Duplicate versions = 1.1.11...