CVE-2026-32463 | Critical | 9.9 | 2026-08-18 | Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions. |
CVE-2026-28192 | Critical | 9.6 | 2026-08-18 | Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions. |
CVE-2026-73996 | Critical | 9.8 | 2026-08-18 | Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. |
CVE-2026-66627 | Critical | 9.9 | 2026-08-18 | Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions. |
CVE-2026-32474 | Critical | 9.9 | 2026-08-18 | Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions. |
CVE-2024-14046 | Medium | 6.3 | 2026-08-18 | A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/… |
CVE-2026-15748 | Critical | 9.8 | 2026-08-18 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload functi… |
CVE-2026-65640 | High | 8.8 | 2026-08-17 | WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.
Prerequisites:
* Imag… |
CVE-2026-50768 | Critical | 9.8 | 2026-08-17 | File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attach… |
CVE-2026-16137 | High | 7.2 | 2026-08-17 | In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiat… |
CVE-2026-74845 | High | 8.8 | 2026-08-17 | Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload… |
CVE-2026-16098 | Critical | 9.8 | 2026-08-16 | The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpl… |
CVE-2026-14498 | High | 8.8 | 2026-08-16 | The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter paramet… |
CVE-2026-74767 | | | 2026-08-15 | Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA arch… |
CVE-2026-18438 | High | 8.8 | 2026-08-15 | The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Executio… |
CVE-2026-15965 | High | 8.8 | 2026-08-15 | The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and inc… |
CVE-2026-19839 | Medium | 4.7 | 2026-08-14 | A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. T… |
CVE-2026-66271 | High | 7.2 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attac… |
CVE-2026-66270 | High | 7.2 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attac… |
CVE-2026-58428 | Medium | 6.5 | 2026-08-13 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) |
CVE-2026-49827 | Critical | 9.8 | 2026-08-13 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbi… |
CVE-2026-65939 | Medium | 6.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS we… |
CVE-2026-18391 | Critical | 9.8 | 2026-08-12 | The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage… |
CVE-2026-15039 | Critical | 9.8 | 2026-08-12 | The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload a… |
CVE-2026-55676 | High | 8.8 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores… |
CVE-2026-13457 | High | 7.5 | 2026-08-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6… |
CVE-2026-72762 | | | 2026-08-11 | n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter… |
CVE-2026-72557 | High | 8.8 | 2026-08-11 | An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset… |
CVE-2026-24330 | Medium | 6.5 | 2026-08-11 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted so… |
CVE-2026-72592 | Critical | 9.8 | 2026-08-10 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server… |
CVE-2026-19089 | Critical | 9.8 | 2026-08-10 | The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, whi… |
CVE-2026-16985 | High | 8.8 | 2026-08-10 | The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update act… |
CVE-2026-19383 | Medium | 4.7 | 2026-08-10 | A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/… |
CVE-2026-19210 | Medium | 6.3 | 2026-08-07 | A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_… |
CVE-2022-4995 | Critical | 9.8 | 2026-08-07 | Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary fil… |
CVE-2026-71434 | Medium | 5.3 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restri… |
CVE-2026-70558 | Critical | 9.8 | 2026-08-06 | Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path… |
CVE-2026-67688 | Critical | 9.8 | 2026-08-06 | ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execu… |
CVE-2026-3418 | Critical | 9.1 | 2026-08-06 | The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to… |
CVE-2026-19065 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file up… |
CVE-2026-66665 | Critical | 10.0 | 2026-08-06 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. |
CVE-2026-18969 | High | 7.3 | 2026-08-06 | A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dis… |
CVE-2026-18927 | Medium | 6.3 | 2026-08-05 | A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. T… |
CVE-2026-18933 | High | 7.2 | 2026-08-05 | The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_… |
CVE-2026-6147 | High | 8.8 | 2026-08-05 | The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all… |
CVE-2026-54416 | High | 7.2 | 2026-08-05 | Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','ph… |
CVE-2026-14553 | High | 8.1 | 2026-08-05 | The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original fil… |
CVE-2026-65986 | | | 2026-08-04 | CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be a… |
CVE-2026-18788 | High | 7.3 | 2026-08-04 | A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.ph… |
CVE-2026-14175 | Critical | 9.8 | 2026-08-04 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload… |
CVE-2026-67243 | High | 7.2 | 2026-08-04 | freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges fo… |
CVE-2026-16618 | Critical | 9.8 | 2026-08-04 | The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the… |
CVE-2026-16548 | Medium | 6.5 | 2026-08-04 | The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type… |
CVE-2026-61524 | High | 7.2 | 2026-08-03 | WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators… |
CVE-2026-39931 | High | 7.2 | 2026-08-03 | OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or… |
CVE-2026-16250 | Critical | 9.8 | 2026-08-03 | The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthe… |
CVE-2026-16060 | Critical | 9.8 | 2026-08-03 | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a… |
CVE-2026-12872 | Critical | 9.8 | 2026-08-03 | The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capabil… |
CVE-2026-13158 | High | 7.2 | 2026-08-01 | The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is dis… |
CVE-2026-13157 | High | 7.2 | 2026-08-01 | The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabl… |
CVE-2026-53599 | High | 7.5 | 2026-07-31 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php l… |
CVE-2026-21662 | Critical | 9.8 | 2026-07-31 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.
This issue affects FM Syst… |
CVE-2026-16236 | High | 8.8 | 2026-07-31 | The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file exten… |
CVE-2026-14483 | Critical | 9.8 | 2026-07-31 | The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via t… |
CVE-2026-63223 | Critical | 9.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client file… |
CVE-2026-67206 | High | 8.8 | 2026-07-30 | Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP fi… |
CVE-2026-44103 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates with… |
CVE-2026-44097 | High | 7.1 | 2026-07-30 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent… |
CVE-2026-16610 | Critical | 9.8 | 2026-07-30 | The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recur… |
CVE-2026-65885 | High | 8.8 | 2026-07-29 | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitra… |
CVE-2026-14270 | High | 8.8 | 2026-07-29 | The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versi… |
CVE-2026-63228 | Low | 2.6 | 2026-07-29 | An unrestricted image upload vulnerability in
Koollab LMS allowed
an authenticated attacker to upload malicious content disguised as an image
file via the feed… |
CVE-2026-63227 | Critical | 9.9 | 2026-07-29 | An unrestricted SCORM file upload vulnerability
in Koollab LMS allowed
an authenticated module designer to upload a SCORM package containing a PHP
webshell to… |
CVE-2026-12476 | High | 7.2 | 2026-07-29 | The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file… |
CVE-2026-13714 | Critical | 9.8 | 2026-07-27 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality… |
CVE-2026-10818 | High | 8.1 | 2026-07-25 | The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize f… |
CVE-2026-24727 | | | 2026-07-24 | An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v1… |
CVE-2026-65461 | Critical | 9.1 | 2026-07-23 | Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. |
CVE-2026-65455 | Critical | 9.1 | 2026-07-23 | Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions. |
CVE-2026-27064 | Critical | 9.1 | 2026-07-23 | Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. |
CVE-2026-14282 | Critical | 9.8 | 2026-07-23 | The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary fi… |
CVE-2026-63048 | | | 2026-07-22 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated ar… |
CVE-2026-16451 | Medium | 6.3 | 2026-07-21 | A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/s… |
CVE-2026-16447 | High | 7.3 | 2026-07-21 | A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation… |
CVE-2026-16332 | High | 7.3 | 2026-07-21 | A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of t… |
CVE-2026-16331 | High | 7.3 | 2026-07-21 | A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation… |
CVE-2026-16330 | High | 7.3 | 2026-07-21 | A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipu… |
CVE-2026-16329 | High | 7.3 | 2026-07-21 | A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the ar… |
CVE-2026-16327 | High | 7.3 | 2026-07-21 | A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulati… |
CVE-2026-16324 | High | 7.3 | 2026-07-20 | A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp… |
CVE-2026-53593 | High | 8.8 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploa… |
CVE-2026-61900 | | | 2026-07-20 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an una… |
CVE-2026-61424 | | | 2026-07-20 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to… |
CVE-2026-60032 | | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbit… |
CVE-2026-63429 | High | 8.6 | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validatio… |
CVE-2026-45797 | | | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Upload… |
CVE-2026-57311 | | | 2026-07-20 | Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Executio… |
CVE-2026-16226 | Medium | 4.7 | 2026-07-19 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php… |
CVE-2026-48062 | Critical | 9.8 | 2026-07-17 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIM… |
CVE-2026-36669 | Critical | 9.8 | 2026-07-17 | An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (su… |