| CVE-2026-16332 |
2026-07-20 |
A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestr… |
| CVE-2026-16331 |
2026-07-20 |
A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Malicious Handler leads … |
| CVE-2026-16330 |
2026-07-20 |
A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n928… |
| CVE-2026-16329 |
2026-07-20 |
A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestr… |
| CVE-2026-16327 |
2026-07-20 |
A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unres… |
| CVE-2026-16324 |
2026-07-20 |
A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulation of the argument File … |
| CVE-2026-53593 |
2026-07-20 |
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads (`Helper::$restricted_extensions`) is … |
| CVE-2026-61900 |
2026-07-20 |
The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE. |
| CVE-2026-61424 |
2026-07-20 |
The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE. |
| CVE-2026-60032 |
2026-07-20 |
The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits. |
| CVE-2026-63429 |
2026-07-20 |
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no ses… |
| CVE-2026-45797 |
2026-07-20 |
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets d… |
| CVE-2026-57311 |
2026-07-20 |
Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution.
Because vendor contact attempts were … |
| CVE-2026-16226 |
2026-07-19 |
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img ca… |
| CVE-2026-48062 |
2026-07-17 |
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of th… |
| CVE-2026-36669 |
2026-07-17 |
An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/ … |
| CVE-2026-13352 |
2026-07-17 |
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up… |
| CVE-2026-12684 |
2026-07-16 |
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachme… |
| CVE-2026-50124 |
2026-07-15 |
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 da… |
| CVE-2026-61457 |
2026-07-15 |
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final fil… |