Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,631

Export CSV
CVE-2026-9445

SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload

A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component File Extension Handler. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Simple Pos And Inventory System
CVE-2026-9421

KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted upload

A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of the component File Handler. This manipulation causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Klik-socialmediawebsite Project Klik Socialmediawebsite
Products
Klik-socialmediawebsite Klik Socialmediawebsite
CVE-2012-10027

WordPress Plugin WP-Property <= 1.35.0 PHP File Upload

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed
Vendors
Wordpress Wp-property Wp-property-hive
Products
Wordpress Wp-property Wordpress Plugin Wordpress Plugin
CVE-2026-6960

BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field

The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Repute Infosystems Wordpress
Products
Bookingpress Appointment Booking Pro Wordpress
CVE-2026-9053

Mothra Default Path Upload Exploit

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
9front
Products
9front
CVE-2023-1728

Unrestricted Upload of File with Dangerous Type in Fernus LMS

Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Fernus
Products
Learning Management Systems
CVE-2023-2712

Malicious File Upload vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform.

Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command Injection, Using Malicious Files, Upload a Web Shell to a Web Server. This issue affects Rental Module: before 23.05.15.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Rental Module Project
Products
Rental Module
CVE-2023-3049

File Upload in TMT's Lockcell

Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. This issue affects Lockcell: before 15.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Tmtmakine
Products
Lockcell Lockcell Firmware
CVE-2023-3375

Unrestricted File Upload in Bookreen

Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
Bookreen
Products
Bookreen
CVE-2026-45444

WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpswings
Products
Wordpress Ultimate Gift Cards For Woocommerce
CVE-2026-9157

Remote Code Execution in Gmission Web FAX

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Gmission
Products
Web Fax
CVE-2026-9102

Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Altium
Products
On-prem Enterprise Server
CVE-2023-5637

Plaintext Storage of a Password in ArslanSoft's Education Portal

Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable. This issue affects Education Portal: before v1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arslansoft Education Portal Project
Products
Arslansoft Education Portal
CVE-2023-6675

Malicious File Upload in National Keep's CyberMath

Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server. This issue affects CyberMath: from v.1.4 before v.1.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath
CVE-2026-4885

Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Piotnet Wordpress
Products
Piotnet Addons For Elementor Wordpress
CVE-2026-42844

Grav: Low-privileged API users can create super-admin accounts via blueprint-upload

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav
CVE-2026-44566

Open WebUI: Arbitrary File Upload and Path Traversal

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, when attaching files to a promp, the name of the file is derived from the original HTTP upload request and is not validated or sanitized. This allows for users to upload files with names containing dot-segments in the file path and traverse out of the intended uploads directory. Effectively, users can upload files anywhere on the filesystem the user running the web server has permission. This vulnerability is fixed in 0.1.124.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Open-webui Openwebui
Products
Open-webui Open Webui
CVE-2026-2743

SEPPmail User Web Interface Arbitrary File Write to RCE

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT). This issue affects SeppMail: 15.0.2.1 and before

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Seppmail
Products
Seppmail
CVE-2026-45315

Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHE_DIR/audio/transcriptions/.. The /cache/{path} route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no Content-Disposition. A verified user with the default-on chat.stt permission can upload a polyglot WAV+HTML file named pwn.html and trick any other user into opening the resulting URL — the response comes back as text/html and any embedded <script> runs in the Open WebUI origin. This vulnerability is fixed in 0.9.3.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-webui Openwebui
Products
Open-webui Open Webui