Total
4394 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-2334 | 2026-08-31 | N/A | N/A | ||
| An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch. | |||||
| CVE-2026-67688 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code. | |||||
| CVE-2026-18983 | 2026-08-28 | N/A | 7.5 HIGH | ||
| The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type header rather than a server-derived type, and no cleanup of files that fail the check. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. in order to exploit this vulnerability an admin has to give subscribers permission to upload avatars. While PHP files and svg files are rejected, dxfp files are accepted. | |||||
| CVE-2026-54416 | 2026-08-28 | N/A | 7.2 HIGH | ||
| Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename. | |||||
| CVE-2026-72592 | 2026-08-28 | N/A | 9.8 CRITICAL | ||
| An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path. | |||||
| CVE-2026-77018 | 2026-08-28 | N/A | 8.8 HIGH | ||
| The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution. | |||||
| CVE-2026-79706 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory. | |||||
| CVE-2026-77991 | 2026-08-28 | N/A | N/A | ||
| Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution. | |||||
| CVE-2026-67243 | 2026-08-28 | N/A | 7.2 HIGH | ||
| freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands. | |||||
| CVE-2026-64960 | 2026-08-28 | N/A | N/A | ||
| ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid course_id can upload a server-executable malicious script. The uploaded file can then be requested over HTTP, resulting in remote code execution as the web server process user. In most cases, course_id=0 can be used, as it commonly represents the global context. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable. | |||||
| CVE-2026-78274 | 2026-08-28 | N/A | 9.1 CRITICAL | ||
| Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. | |||||
| CVE-2026-48356 | 1 Adobe | 4 Commerce, Commerce B2b, I\/o Events and 1 more | 2026-08-28 | N/A | 9.3 CRITICAL |
| Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | |||||
| CVE-2026-48283 | 1 Adobe | 1 Coldfusion | 2026-08-28 | N/A | 10.0 CRITICAL |
| ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-48276 | 1 Adobe | 1 Coldfusion | 2026-08-28 | N/A | 10.0 CRITICAL |
| ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-32559 | 2026-08-27 | N/A | 9.9 CRITICAL | ||
| Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions. | |||||
| CVE-2026-16601 | 2026-08-27 | N/A | 8.8 HIGH | ||
| The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page. | |||||
| CVE-2026-63048 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE. | |||||
| CVE-2026-18933 | 2026-08-26 | N/A | 7.2 HIGH | ||
| The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler. | |||||
| CVE-2026-58428 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | |||||
| CVE-2026-75496 | 2026-08-26 | N/A | 7.2 HIGH | ||
| Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c. | |||||