Monthly
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achieve first-party script execution in other users' browser sessions by exploiting an extension-confusion flaw in the product photo upload feature. The application validates file content via magic bytes and rejects known PHP extensions, but then names the stored file using the attacker-supplied client extension - allowing a file prefixed with an image header and carrying an .html extension to pass validation, land in the public web root, and be served as text/html. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 4.8 reflects the authentication and victim-interaction prerequisites.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Arbitrary PHP file upload leading to remote code execution in the Joomla Event Manager extension (joomlaeventmanager.net) versions before 5.0.1 allows an authenticated administrator to write dangerous file types through the administrator source model and execute code on the underlying server. The flaw is a CWE-434 unrestricted upload weakness that turns legitimate back-end file-handling into a webshell delivery path; no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 9.4 reflects total confidentiality, integrity, and availability impact, though exploitation requires existing high privileges (PR:H).
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote attackers to upload web shell backdoors and achieve full arbitrary code execution on the underlying server. The CVSS 4.0 score of 8.7 reflects network-accessible exploitation requiring only low-privilege credentials, with confirmed total technical impact per SSVC. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the Taiwan CERT (TWCERT) has published advisories indicating confirmed vendor awareness.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achieve first-party script execution in other users' browser sessions by exploiting an extension-confusion flaw in the product photo upload feature. The application validates file content via magic bytes and rejects known PHP extensions, but then names the stored file using the attacker-supplied client extension - allowing a file prefixed with an image header and carrying an .html extension to pass validation, land in the public web root, and be served as text/html. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 4.8 reflects the authentication and victim-interaction prerequisites.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Arbitrary PHP file upload leading to remote code execution in the Joomla Event Manager extension (joomlaeventmanager.net) versions before 5.0.1 allows an authenticated administrator to write dangerous file types through the administrator source model and execute code on the underlying server. The flaw is a CWE-434 unrestricted upload weakness that turns legitimate back-end file-handling into a webshell delivery path; no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 9.4 reflects total confidentiality, integrity, and availability impact, though exploitation requires existing high privileges (PR:H).
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote attackers to upload web shell backdoors and achieve full arbitrary code execution on the underlying server. The CVSS 4.0 score of 8.7 reflects network-accessible exploitation requiring only low-privilege credentials, with confirmed total technical impact per SSVC. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the Taiwan CERT (TWCERT) has published advisories indicating confirmed vendor awareness.