CVE-2026-25328 WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through = 2.2.4...

CVE-2026-25328 WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through = 2.2.4...

CVE-2026-25328

CVE-2026-25328 is a path traversal vulnerability in the WordPress plugin “Product File Upload for WooCommerce” (

CVE-2026-20115

A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by...

CVE-2026-20115

A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by...

EUVD-2026-15421

Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. Fixed in 12.3.6...

CVE-2026-3215 Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215 Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215 Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-33268

Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. Fixed in 12.3.6...

CVE-2026-33268

Nanoleaf Lines (firmware 12.3.2) is affected by CVE-2026-33268 due to unauthenticated firmware uploads, allowing a remote attacker to upload firmware and consume storage resources. The issue is network-accessible with no required privileges and could impact availability and, to a lesser extent, i...

SUSE CVE-2026-28682

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...

SUSE CVE-2026-28683

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3...

PT-2026-27998

Name of the Vulnerable Software and Affected Versions deothemes Ona versions prior to 1.24 Description The software contains a flaw related to unrestricted file upload with a dangerous file type. This allows for the upload of a web shell to a web server. Recommendations Update to a version newer...

PT-2026-27774

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.4 Description The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as Attachment.sourceId...

WordPress plugin Product File Upload for WooCommerce 路径遍历漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

PT-2026-28038

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through = 6.4.9...

PT-2026-27900

Name of the Vulnerable Software and Affected Versions Product File Upload for WooCommerce versions n/a through 2.2.4 Description An improper limitation of a pathname to a restricted directory, specifically a 'Path Traversal' issue, exists in Product File Upload for WooCommerce. This allows for...

Nanoleaf Lines unauthenticated firmware file store

RISK EVALUATION Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. 2. RECOMMENDED PRACTICES Update to 12.3.6. 3. DESCRIPTION Nanoleaf Lines 12.3.2 does not authenticate...

PT-2026-27941

Name of the Vulnerable Software and Affected Versions WPBookit Pro versions n/a through 1.6.18 Description The software contains a flaw that permits the upload of malicious files due to unrestricted file upload with a dangerous type. This allows for the use of malicious files. Recommendations...