CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unrestricted File Upload to RCE Description Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/ endpoint. The uploadFile function performs no file extension or...

CVE-2026-103541

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

CVE-2026-103541 formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

EUVD-2026-90499

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

CVE-2026-103541 formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

CVE-2026-103541 formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

CVE-2026-103541

A vulnerability exists in formtools.org Form Tools up to version 3.1.1 . The flaw is located in the Ajax Handler component, specifically within the Files::uploadFile function of the global/code/actions.php file. This issue allows for unrestricted upload via a remote attack vector. While the proje...

PT-2026-97033

Name of the Vulnerable Software and Affected Versions WuzhiCMS version 5.0.0 Description An unrestricted file upload issue exists in the thumbnail-upload endpoint '/index.php?m=member&f=article&v=thumbUpload'. An authenticated low-privileged member can upload a crafted .php file to execute...

CVE-2026-88419

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

CVE-2026-86668

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-86668

A cross-site scripting (XSS) vulnerability exists in aircheng-org iWebShop-5 (versions up to 5.15 ), located in the uploadFile function within the file controllers/pic.php . Manipulation of the outerSrc/selectPhoto argument enables the attack remotely with no required privileges, though user inte...

CVE-2026-86668 aircheng-org iWebShop-5 pic.php uploadFile cross site scripting

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-86668 aircheng-org iWebShop-5 pic.php uploadFile cross site scripting

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

EUVD-2026-72932

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-86668 aircheng-org iWebShop-5 pic.php uploadFile cross site scripting

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666

A unrestricted file upload vulnerability affects aircheng-org iWebShop-5 versions up to 5.15 . The flaw resides in the upload_json/uploadFile function within the controllers/pic.php file, allowing a remote, unauthenticated attacker to upload arbitrary files. The CVSS 3.1 score is 7.3 (HIGH) , ref...

PT-2026-87185

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...