Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,871

Export CSV
CVE-2026-42748

WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WPify WPify Woo Czech wpify-woo allows Upload a Web Shell to a Web Server.This issue affects WPify Woo Czech: from n/a through <= 5.4.1.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpify
Products
Wordpress Woo Czech
CVE-2026-5718

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).

CVSS 3.1 · 8.1 High EPSS 5.4% KEV · Not listed
Vendors
Glenwpcoder Wordpress
Products
Drag And Drop Multiple File Upload For Contact Form 7 Wordpress
CVE-2026-8134

Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H   Thanks Yonatan Drori (Tenzai) for reporting.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Concretecms
Products
Concrete Cms
CVE-2026-9374

yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yangzongzhuan
Products
Ruoyi-vue
CVE-2026-9445

SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload

A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component File Extension Handler. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Simple Pos And Inventory System
CVE-2026-9421

KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted upload

A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of the component File Handler. This manipulation causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Klik-socialmediawebsite Project Klik Socialmediawebsite
Products
Klik-socialmediawebsite Klik Socialmediawebsite
CVE-2012-10027

WordPress Plugin WP-Property <= 1.35.0 PHP File Upload

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed
Vendors
Wordpress Wp-property Wp-property-hive
Products
Wordpress Wp-property Wordpress Plugin Wordpress Plugin
CVE-2026-6960

BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field

The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Repute Infosystems Wordpress
Products
Bookingpress Appointment Booking Pro Wordpress
CVE-2026-9053

Mothra Default Path Upload Exploit

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
9front
Products
9front
CVE-2023-1728

Unrestricted Upload of File with Dangerous Type in Fernus LMS

Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Fernus
Products
Learning Management Systems
CVE-2023-2712

Malicious File Upload vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform.

Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command Injection, Using Malicious Files, Upload a Web Shell to a Web Server. This issue affects Rental Module: before 23.05.15.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Rental Module Project
Products
Rental Module
CVE-2023-3049

File Upload in TMT's Lockcell

Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. This issue affects Lockcell: before 15.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Tmtmakine
Products
Lockcell Lockcell Firmware
CVE-2023-3375

Unrestricted File Upload in Bookreen

Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
Bookreen
Products
Bookreen
CVE-2026-40165

authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an attacker to trick authentik into only seeing a part of the NameID value, potentially allowing an attacker to gain access to other accounts. This issue could be exploited on an authentik instance with a SAML Source, where the attacker had an account on the SAML Source and the ability to modify their NameID value (commonly username or E-mail), and XML Signing was enabled. The attacker could modify the SAML assertion given to authentik by injecting a comment within the NameID value, which effectively truncated the NameID value to the snippet before the comment, and gave the attacker access to any user account. This issue has been fixed in versions 2025.12.5 and 2026.2.3.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Goauthentik
Products
Authentik
CVE-2026-45444

WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpswings
Products
Wordpress Ultimate Gift Cards For Woocommerce
CVE-2026-9157

Remote Code Execution in Gmission Web FAX

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Gmission
Products
Web Fax
CVE-2026-9102

Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Altium
Products
On-prem Enterprise Server
CVE-2023-5637

Plaintext Storage of a Password in ArslanSoft's Education Portal

Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable. This issue affects Education Portal: before v1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arslansoft Education Portal Project
Products
Arslansoft Education Portal
CVE-2023-6675

Malicious File Upload in National Keep's CyberMath

Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server. This issue affects CyberMath: from v.1.4 before v.1.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath