Total
4402 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-4096 | 1 Radykal | 1 Fancy Product Designer | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5. | |||||
| CVE-2021-4080 | 1 Craterapp | 1 Crater | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| crater is vulnerable to Unrestricted Upload of File with Dangerous Type | |||||
| CVE-2021-47965 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise. | |||||
| CVE-2021-47904 | 2026-06-17 | N/A | 8.8 HIGH | ||
| PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server. | |||||
| CVE-2021-47899 | 2026-06-17 | N/A | 4.0 MEDIUM | ||
| YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote file upload feature. Attackers can exploit the url parameter in the url_upload_handler endpoint to access sensitive files like /etc/passwd by using file:/// protocol. | |||||
| CVE-2021-47888 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files. Attackers can upload a PHP file with a shell command execution payload and execute arbitrary commands by accessing the uploaded file through a specific URL parameter. | |||||
| CVE-2021-47819 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution capabilities. Attackers can upload a PHP script through the profile attachment section and execute system commands by accessing the uploaded file with a specially crafted request parameter. | |||||
| CVE-2021-47788 | 1 Websitebaker | 1 Websitebaker | 2026-06-17 | N/A | 8.8 HIGH |
| WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server. | |||||
| CVE-2021-47783 | 1 Phpwcms | 1 Phpwcms | 2026-06-17 | N/A | 5.4 MEDIUM |
| Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform. | |||||
| CVE-2021-47758 | 1 Chikitsa | 1 Patient Management System | 2026-06-17 | N/A | 8.8 HIGH |
| Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables arbitrary command execution on the server through a weaponized PHP script. | |||||
| CVE-2021-47757 | 1 Chikitsa | 1 Patient Management System | 2026-06-17 | N/A | 8.8 HIGH |
| Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server. | |||||
| CVE-2021-47753 | 1 Phpkf | 1 Cms | 2026-06-17 | N/A | 9.8 CRITICAL |
| phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension checks. Attackers can upload a PHP file disguised as a PNG, rename it, and execute system commands through a crafted web shell parameter. | |||||
| CVE-2021-46428 | 1 Simple Chatbot Application Project | 1 Simple Chatbot Application | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avatar parameter in SystemSettings.php. | |||||
| CVE-2021-46386 | 1 Mingsoft | 1 Mcms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload. | |||||
| CVE-2021-46367 | 1 Ritecms | 1 Ritecms | 2026-06-17 | 9.0 HIGH | 7.2 HIGH |
| RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default. | |||||
| CVE-2021-46360 | 1 Ocproducts | 1 Composr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr. | |||||
| CVE-2021-46113 | 1 Kea-hotel-erp Project | 1 Kea-hotel-erp | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service. | |||||
| CVE-2021-46097 | 1 Dolphinphp | 1 Dolphinphp | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log | |||||
| CVE-2021-46079 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection. | |||||
| CVE-2021-46078 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to a Stored Cross-Site Scripting vulnerability. | |||||