Export limit exceeded: 394851 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (4412 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55676 | 1 Cisagov | 1 Malcolm | 2026-08-13 | 8.8 High |
| Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue. | ||||
| CVE-2018-9206 | 1 Jquery File Upload Project | 1 Jquery File Upload | 2026-08-12 | 9.8 Critical |
| Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0 | ||||
| CVE-2026-15039 | 2026-08-12 | 9.8 Critical | ||
| The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution. | ||||
| CVE-2026-19089 | 2 Tychesoftwares, Wordpress | 2 Product Input Fields For Woocommerce, Wordpress | 2026-08-12 | 9.8 Critical |
| The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules. | ||||
| CVE-2026-16548 | 2 Chat Widget, Wordpress | 2 Floating Customer Support Button For 30+ Channels, Supporting Sms, Calls, And Chat, Wordpress | 2026-08-12 | 6.5 Medium |
| The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured. | ||||
| CVE-2026-16985 | 2026-08-11 | 8.8 High | ||
| The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution. | ||||
| CVE-2020-3436 | 1 Cisco | 3 Adaptive Security Appliance, Adaptive Security Appliance Software, Secure Firewall Threat Defense | 2026-08-11 | 8.6 High |
| A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders on an affected device, which could lead to an unexpected device reload. The vulnerability exists because the affected software does not efficiently handle the writing of large files to specific folders on the local file system. An attacker could exploit this vulnerability by uploading files to those specific folders. A successful exploit could allow the attacker to write a file that triggers a watchdog timeout, which would cause the device to unexpectedly reload, causing a denial of service (DoS) condition. | ||||
| CVE-2026-24330 | 1 Redhat | 10 Fuse 7, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 7 more | 2026-08-11 | 6.5 Medium |
| A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities. | ||||
| CVE-2026-72762 | 1 N8n | 1 N8n | 2026-08-11 | N/A |
| n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance. | ||||
| CVE-2026-19383 | 2 Saigroup, Saithink | 2 Saiadmin, Saiadmin | 2026-08-10 | 4.7 Medium |
| A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product is published by multiple vendors. | ||||
| CVE-2026-72592 | 1 Dulldusk | 1 Phpfm | 2026-08-10 | 9.8 Critical |
| An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path. | ||||
| CVE-2026-54416 | 1 Pluck-cms | 1 Pluckcms | 2026-08-10 | 7.2 High |
| Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename. | ||||
| CVE-2026-54414 | 1 Error311 | 1 Filerise | 2026-08-10 | 9.8 Critical |
| FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %). | ||||
| CVE-2026-4809 | 1 Plank | 1 Laravel-mediable | 2026-08-10 | 9.8 Critical |
| plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload. | ||||
| CVE-2026-18933 | 2 Wordpress, Wpdownloadmanager | 2 Wordpress, Download Manager | 2026-08-10 | 7.2 High |
| The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler. | ||||
| CVE-2026-67688 | 2026-08-07 | 9.8 Critical | ||
| ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code. | ||||
| CVE-2026-19210 | 1 Sourcecodester | 1 Photo Share Website | 2026-08-07 | 6.3 Medium |
| A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-19065 | 1 Sourcecodester | 1 Online Examination Learning Management System | 2026-08-07 | 6.3 Medium |
| A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file upload_files.php. This manipulation causes unrestricted upload. The attack may be initiated remotely. | ||||
| CVE-2026-3418 | 1 Wso2 | 12 Api Control Plane, Api Manager, Carbon Api Management Api and 9 more | 2026-08-07 | 9.1 Critical |
| The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution. | ||||
| CVE-2026-71434 | 1 Statamic | 1 Cms | 2026-08-07 | 5.3 Medium |
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2. | ||||