aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload
CVE-2026-86666
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFi
#cwe-434
共收录 549 条相关情报。
← 返回所有主题A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control...
CVE-2026-50093
A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control P
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Up...
CVE-2026-86305
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814c
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execu...
CVE-2026-44402
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmw
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the ...
CVE-2026-12483
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?a...
CVE-2026-85208
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the fun
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller...
CVE-2026-85186
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is th
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repositor...
CVE-2026-85135
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::upload
ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload
CVE-2026-85135
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::upload
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provi...
CVE-2026-76174
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The a
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated...
CVE-2026-82524
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to uplo
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload e...
CVE-2026-82524
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to uplo
UnoPim File Upload RCE via TinyMCE Image Upload Endpoint
CVE-2026-82524
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to uplo
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildc...
CVE-2026-53649
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
CVE-2026-53649
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthe...
CVE-2026-4357
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as wel
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component
CVE-2025-9314
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in th
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker w...
CVE-2026-19219
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters u
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment prot...
CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows,
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file u...
CVE-2026-19513
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.