CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

CVE-2026-48707

InstantCMS versions prior to 2.18.2 contain a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php, lines 509–532). When the "upload from URL" feature follows an HTTP redirect , the redirected target URL bypasses the private IP address blackl...

CVE-2026-54611

InstantCMS , a free and open-source content management system, contains a Remote Code Execution vulnerability in its component installer in versions prior to 2.18.2 . A remote authenticated attacker can upload a malicious component; although the component is not formally installed, the uploaded P...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-86666

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

Security Bulletin: A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem

Summary A path traversal vulnerability existed in two independent file handling mechanisms used by the product's workflow execution and file management capabilities. The file upload endpoint accepted multipart filenames directly from HTTP request metadata without sanitization, allowing an...

CVE-2026-86666

A unrestricted file upload vulnerability affects aircheng-org iWebShop-5 versions up to 5.15 . The flaw resides in the upload_json/uploadFile function within the controllers/pic.php file, allowing a remote, unauthenticated attacker to upload arbitrary files. The CVSS 3.1 score is 7.3 (HIGH) , ref...

EUVD-2026-72934

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

Exploit for CVE-2026-57811

CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate Unauth...

CVE-2026-77097

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...

EUVD-2026-72725

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...

CVE-2026-77097 Private Metrics Server Denial of Service

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...

CVE-2026-77097 Private Metrics Server Denial of Service

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...

CVE-2026-77097

Commvault Private Metrics Server is affected by a missing authentication condition that impacts the metrics upload functionality, allowing an unauthenticated network-based attacker to cause a denial of service (high availability impact, low integrity impact). The CNA (Commvault) rates this CVSS 4...