170 matches found
CVE-2026-105606
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
EUVD-2026-115367
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606
The Joomla Extension - joomlaboat.com (versions prior to 3.7.8 ) is vulnerable to an unauthenticated arbitrary file upload in the Custom Tables component. An attacker can upload a polyglot file with a controlled extension to a web-accessible tmp directory via a public submission form, as the stor...
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606: joomlaboat.com Custom Tables extension for Joomla: Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated…
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
PT-2026-135637
Name of the Vulnerable Software and Affected Versions Custom Tables versions prior to 3.7.8 Description An unauthenticated attacker can upload a polyglot file with a controlled extension to the web-accessible tmp directory of a Joomla site that exposes a public Custom Tables submission form. A...
CLEANSTART-2024-TA68556 Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy
CVE-2022-22761 affects multiple packages. Web-accessible extension pages pages with a moz-extension:// scheme were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. See references for individual vulnerability details...
PT-2026-111726
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessib...
CVE-2026-13607
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
PT-2026-104729
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
EUVD-2026-91482
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...
CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...
EUVD-2026-64064
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...
PT-2026-79436
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...
CVE-2026-64960
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
PT-2026-79008
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid course id can upload a...
Insecure Temporary File
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insecure Temporary File through the process that writes backup ZIP archives to a web-accessible location. An attacker can access sensitive files,...