Lucene search
+L

8595 matches found

Nuclei
Nuclei
added yesterday28 views

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

9.8CVSS9.4AI score0.06944EPSS
SaveExploits1References4
Nuclei
Nuclei
added yesterday23 views

WordPress File Manager <= 7.2.1 - Directory Traversal

File Manager and File Manager Pro plugins for WordPress versions up to 7.2.1 and 8.3.4 contain a directory traversal caused by the 'target' parameter in mkfilefoldermanageractioncallbackshortcode, letting attackers read arbitrary files and upload files outside designated directories, exploit...

9.9CVSS8.6AI score0.06009EPSS
SaveExploits0References2
Nuclei
Nuclei
added yesterday173 views

MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

8.7CVSS7.5AI score0.02402EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2 days ago55 views

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

9.8CVSS8.1AI score0.57807EPSS
SaveExploits8References2
EUVD
EUVD
added 2 days ago11 views

EUVD-2026-54734

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when...

5.3AI score0.00152EPSS
SaveExploits0References1
EUVD
EUVD
added 3 days ago14 views

EUVD-2026-51399

CodeIgniter: Uploaded file extension validation bypass in isimage and mimein rules...

9.8CVSS5.2AI score0.00493EPSS
SaveExploits2References4
NVD
NVD
added 3 days ago10 views

CVE-2022-4995

Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...

9.8CVSS0.00687EPSS
SaveExploits0References6
Cvelist
Cvelist
added 3 days ago36 views

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

9.8CVSS0.00631EPSS
SaveExploits0References3
CVE
CVE
added 3 days ago42 views

CVE-2026-19264

Postiz is an open-source social media scheduling tool affected by CVE-2026-19264. The vulnerability arises in the route that serves locally stored media, which concatenates URL path segments into the upload directory and streams files without proper path normalization or directory confinement. UR...

9.8CVSS5.4AI score0.00631EPSS
SaveExploits0References3
OSV
OSV
added 3 days ago7 views

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

9.3CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist
added 3 days ago34 views

CVE-2026-54210 TeamDavid: Buffer Overflow in file names of file upload functionalities

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in ...

9.5CVSS0.00466EPSS
SaveExploits0References2
NVD
NVD
added 4 days ago9 views

CVE-2026-71434

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

5.3CVSS0.0024EPSS
SaveExploits0References5
NVD
NVD
added 4 days ago6 views

CVE-2026-3418

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

9.1CVSS0.00521EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago26 views

CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

5.3CVSS0.0024EPSS
SaveExploits0References5
CVE
CVE
added 4 days ago39 views

CVE-2026-71434

CVE-2026-71434 affects Statamic (Laravel/Git-based CMS). Before version 5.74.3 and 6.24.2, public frontend forms did not enforce file upload restrictions that the Control Panel enforces, allowing an unauthenticated visitor to upload file types administrators disallow via assets/files fields. For ...

5.3CVSS5.4AI score0.0024EPSS
SaveExploits0References5
OSV
OSV
added 4 days ago5 views

CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

5.3CVSS5.4AI score
SaveExploits0References7
NVD
NVD
added 4 days ago11 views

CVE-2026-16054

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and...

9.1CVSS0.00274EPSS
SaveExploits0References1
NVD
NVD
added 4 days ago11 views

CVE-2025-15678

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

6.1CVSS0.00149EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago8 views

EUVD-2025-210624

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

6.1CVSS5.4AI score0.00149EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago29 views

CVE-2025-15678

The CVE concerns the Nexter Blocks WordPress plugin before version 5.0.2. It does not sanitize uploaded SVG files, allowing any user who can upload files (Author by default) to upload an SVG containing malicious JavaScript. When the file is accessed, this can execute in the context of the site, l...

6.1CVSS5.4AI score0.00149EPSS
SaveExploits0References1
Rows per page
Query Builder