#cwe-434

共收录 549 条相关情报。

← 返回所有主题
漏洞预警2026-09-01 发布INFO

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker c...

CVE-2026-84147

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation

历史摘要 · 未重新核验 · NVD

安全公告2026-09-01 发布INFO

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode...

CVE-2026-75865

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress i

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-01 发布INFO

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file...

CVE-2026-75865

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress i

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-31 发布INFO

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_i...

CVE-2026-82921

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/

历史摘要 · 未重新核验 · NVD

安全公告2026-08-31 发布INFO

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

CVE-2026-81780

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-08-31 发布INFO

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetype...

CVE-2026-81891

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractIte

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-31 发布INFO

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

CVE-2026-81780

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-31 发布INFO

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0...

CVE-2026-54179

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages tha

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-31 发布INFO

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affe...

CVE-2026-82970

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePriva

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-31 发布INFO

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and ba...

CVE-2026-78078

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Imag

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-31 发布INFO

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBas...

CVE-2026-82679

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the

历史摘要 · 未重新核验 · NVD

安全公告2026-08-31 发布INFO

diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload

CVE-2026-82679

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-08-31 发布INFO

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the fil...

CVE-2026-82629

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affect

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-31 发布INFO

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admi...

CVE-2026-82607

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the fu

历史摘要 · 未重新核验 · NVD

安全公告2026-08-29 发布INFO

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that al

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-08-29 发布INFO

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissio...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that al

历史摘要 · 未重新核验 · NVD

安全公告2026-08-29 发布INFO

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions...

CVE-2026-14494

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-08-29 发布INFO

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due ...

CVE-2026-14494

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-28 发布INFO

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthentica...

CVE-2026-79706

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to buil

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-28 发布INFO

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_proc...

CVE-2026-18983

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers

历史摘要 · 未重新核验 · NVD