Lucene search
+L

8599 matches found

ATTACKERKB
ATTACKERKB
added 3 hours ago2 views

CVE-2026-19089

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 3 hours ago2 views

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

SaveExploits0References1
CVE
CVE
added 3 hours ago11 views

CVE-2026-16985

The CVE affects the Squeeze WordPress plugin prior to version 1.7.12. The issue arises because the plugin does not validate the file type or extension of per-size image data written during an attachment-update action, allowing users with the upload_files capability (Author and above) to write an ...

5.8AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 3 hours ago2 views

CVE-2026-17019

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...

SaveExploits0References1
Nuclei
Nuclei
added yesterday28 views

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

9.8CVSS9.4AI score0.06944EPSS
SaveExploits1References4
Nuclei
Nuclei
added yesterday23 views

WordPress File Manager <= 7.2.1 - Directory Traversal

File Manager and File Manager Pro plugins for WordPress versions up to 7.2.1 and 8.3.4 contain a directory traversal caused by the 'target' parameter in mkfilefoldermanageractioncallbackshortcode, letting attackers read arbitrary files and upload files outside designated directories, exploit...

9.9CVSS8.6AI score0.06009EPSS
SaveExploits0References2
Nuclei
Nuclei
added yesterday173 views

MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

8.7CVSS7.5AI score0.02402EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2 days ago55 views

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

9.8CVSS8.1AI score0.57807EPSS
SaveExploits8References2
EUVD
EUVD
added 2 days ago11 views

EUVD-2026-54734

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when...

5.3AI score0.00152EPSS
SaveExploits0References1
EUVD
EUVD
added 3 days ago14 views

EUVD-2026-51399

CodeIgniter: Uploaded file extension validation bypass in isimage and mimein rules...

9.8CVSS5.2AI score0.00493EPSS
SaveExploits2References4
NVD
NVD
added 3 days ago10 views

CVE-2022-4995

Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...

9.8CVSS0.00687EPSS
SaveExploits0References6
Cvelist
Cvelist
added 3 days ago36 views

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

9.8CVSS0.00631EPSS
SaveExploits1References3
CVE
CVE
added 3 days ago47 views

CVE-2026-19264

Postiz is an open-source social media scheduling tool affected by CVE-2026-19264. The vulnerability arises in the route that serves locally stored media, which concatenates URL path segments into the upload directory and streams files without proper path normalization or directory confinement. UR...

9.8CVSS5.4AI score0.00631EPSS
SaveExploits1References3
OSV
OSV
added 3 days ago7 views

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

9.3CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist
added 3 days ago35 views

CVE-2026-54210 TeamDavid: Buffer Overflow in file names of file upload functionalities

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in ...

9.5CVSS0.00466EPSS
SaveExploits0References2
NVD
NVD
added 4 days ago9 views

CVE-2026-71434

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

5.3CVSS0.0024EPSS
SaveExploits0References5
NVD
NVD
added 4 days ago6 views

CVE-2026-3418

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

9.1CVSS0.00521EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago26 views

CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

5.3CVSS0.0024EPSS
SaveExploits0References5
CVE
CVE
added 4 days ago41 views

CVE-2026-71434

CVE-2026-71434 affects Statamic (Laravel/Git-based CMS). Before version 5.74.3 and 6.24.2, public frontend forms did not enforce file upload restrictions that the Control Panel enforces, allowing an unauthenticated visitor to upload file types administrators disallow via assets/files fields. For ...

5.3CVSS5.4AI score0.0024EPSS
SaveExploits0References5
OSV
OSV
added 4 days ago5 views

CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

5.3CVSS5.4AI score
SaveExploits0References7
Rows per page
Query Builder