File Upload
Monthly
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Unauthenticated path-traversal file writes in the EnergizeLab Eilik and EilikO AI skill upload endpoint allow any remote attacker who can reach the FastAPI AI inference and profiling service to write arbitrary files on the robot's host system by supplying crafted traversal filenames in an upload request. Because the endpoint enforces neither authentication nor path constraints, exploitation is a straightforward, low-complexity primitive that lets an attacker tamper with the AI skill files the robots execute, degrading or subverting robot behavior and causing high integrity and availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-434); confidentiality is assessed as unaffected. The practical limiting factor is network reachability rather than credentials or configuration - these are consumer robots whose service is normally confined to the local network segment, so real-world exposure is materially narrower than the AV:N vector implies, and no public exploit code or confirmed active exploitation was identified at time of analysis (the flaw itself needs no user interaction or non-default toggle once the endpoint is reachable).
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Authentication bypass in FileRise versions before 3.23.0 lets a remote attacker log in as an existing local account - including the built-in administrator - by presenting OIDC claims whose mutable preferred_username value, or an unverified email, collides with that account's local username; the flaw works even when OIDC automatic provisioning is disabled. Successful takeover yields full read, write, and delete control over the file manager and its stored files, consistent with the assessed CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional, not universal: the deployment must be configured for OIDC SSO and the identity provider must allow the colliding claim or omit email_verified, which is what drives the High attack-complexity rating; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vulnerability is fixed in FileRise 3.23.0.
Online second-factor guessing against FileRise releases prior to 3.23.0 is permitted well beyond the intended limit because failed TOTP verification attempts are recorded only in the PHP session rather than in a durable account-wide budget. An attacker who already possesses a valid primary credential (username plus password) for an account with TOTP enabled can abandon the pending login, start a fresh session, or change source address to restore the five-attempt allowance and continue guessing time-based codes indefinitely. Exploitation therefore has a hard precondition - the primary credential - and each guess remains a probabilistic online attempt against a rotating code, but a successful guess yields full account compromise; the vendor addressed the flaw in v3.23.0 and no public exploit code has been identified at time of analysis.
Authorization bypass in FileRise prior to 3.18.0 allows an authenticated, low-privileged user to read - and, when they also hold edit-own permission, modify - files they do not own by exploiting a collision in folder metadata filenames. FileRise flattens logical folder paths into metadata filenames by replacing '/', '\\' and spaces with hyphens, so distinct folders such as team/docs and team-docs resolve to the same <name>_metadata.json file; an attacker who controls one colliding folder and knows the target basename can overwrite the uploader-ownership metadata that read_own and ownership-restricted edit checks rely on, making a victim file appear attacker-owned. The issue is rated CVSS 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) and is fixed in 3.18.0; exploitation requires a multi-user deployment, a crafted colliding folder name, pre-existing read_own access to the target folder and knowledge of the exact victim basename, and no public exploit identified at time of analysis. Single-tenant or single-user installations are effectively unaffected because no second user exists to victimize.
File overwrite in FileRise prior to 3.18.0 allows an unauthenticated visitor who holds a valid upload-enabled shared-folder or upload-only link token - plus any configured share password - to re-upload a file using the exact name of an existing file and silently replace its contents while the original uploader metadata is preserved. The same missing replacement check affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the target file, so the outcome is a high-integrity, no-confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, 8.2). Exploitation requires that an administrator has actually created and shared an upload-capable link and that the attacker knows or guesses the target filename; impact is confined to overwriting existing files, with no data disclosure and no code execution path. No public exploit code was identified at time of analysis, and the vendor-released fix is FileRise 3.18.0.
Unauthenticated administrative account takeover in FileRise versions prior to 3.16.0: because the application treats an empty or missing users.txt as a fresh installation, a remote caller with no credentials can detect that first-run setup has silently reopened and create the next initial administrator account through the setup flow. The empty-user-store condition must first arise from storage loss, truncation, or another failure after setup previously completed (hence the AC:H rating), so reliably-stored, intact installations are not exposed; once that state exists, exploitation requires no authentication and no user interaction (PR:N/UI:N) and yields high confidentiality and integrity impact (CVSS 7.4). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the flaw is trivially reproducible by anyone who notices the exposed setup page.
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid username and password for a TOTP-enabled account to authenticate to the WebDAV endpoint without supplying the second factor, then operate within that account's WebDAV file permissions. The weakness is conditionally gated: the opt-in WebDAV service must have been enabled by an administrator, the targeted account must have TOTP configured, and the attacker must already know the account's primary credentials, which the CVSS vector reflects as authenticated access (PR:L); the normal browser login path was never affected. Rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with high confidentiality and integrity impact and no availability impact; no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in FileRise 3.16.0.
Authentication bypass in FileRise (CWE-290) lets unauthenticated remote attackers impersonate any account - including an administrator - without a password or MFA in deployments prior to 3.16.0 that enable proxy-header authentication (AUTH_BYPASS) and expose the backend port directly. The flaw is that the configured reverse-proxy identity header (X-Remote-User) was trusted without validating that the request actually came from an address in FR_TRUSTED_PROXIES; an attacker who can reach the backend application port therefore simply supplies the header and receives a session for the named account. Exploitation requires proxy-header auth to be enabled, the trusted-proxy check to be absent or ineffective (exactly what 3.16.0 fixes), and a network path to the backend that bypasses the proxy, which is why it is scored AV:N/AC:H/PR:N/UI:N with full confidentiality, integrity, and availability impact (CVSS 3.1: 8.1 High); no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an authenticated back-office user to upload a PHP payload that is written into the web-served public/cache/documents/ directory and executed as the web server user. The flaw exists because FileProcessorService validates the filename exactly as the client sent it, while FileManager::renameFile()/sanitizeFileName() later strips characters outside [a-zA-Z0-9-_.], so a name such as 'report.php ' survives validation but is stored as the executable 'report.php'. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires a valid administrative account with access to the document-upload feature; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.1.2 and 3.2.1.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated multipart uploads to the LogicalDOC Community Edition /upload endpoint (through version 9.3) let remote attackers write files into application temporary directories that are never cleaned up, exhausting server disk space and degrading or halting the document management service. The UploadServlet accepts file parts without a valid session and imposes no limit on the number of parts per request, so no credentials, user interaction, or non-default configuration are needed - only network reachability to the endpoint. Impact is confined to availability (integrity and confidentiality are unaffected, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector), no public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated arbitrary file upload in the Tailored Tools plugin for WordPress (versions up to and including 3.0.3) allows remote attackers to write attacker-controlled files to the web server, which can be escalated to remote code execution where the uploaded file type is executable. The vulnerability is rated CVSS 9.0 (assessed vector AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) and requires no authentication or user interaction, though the high attack-complexity component indicates a non-trivial precondition such as path/filename guessing or a specific plugin configuration that must be satisfied for a successful upload. No public exploit code was identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; real-world exposure is limited mainly by the plugin's narrow deployment footprint.
Authenticated arbitrary file upload in the CodeBard Help Desk WordPress plugin (versions up to and including 1.1.2) lets any logged-in user holding only a subscriber-level account push an executable PHP file onto the server through the plugin's ticket/attachment upload path, which typically converts into full remote code execution on the WordPress host. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - the scope change reflects that a low-privileged plugin user can compromise the whole site, not just the plugin - and requires no administrator rights and no victim interaction, though it does require an account on the target site (trivially obtained wherever open or self-service registration is enabled). At time of analysis there is no CISA KEV entry and no public exploit code identified for this issue; the practical urgency therefore turns on how easily an attacker can register a subscriber account on the target installation. This is a genuine high-priority issue, not a CVSS-inflated one.
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
Remote code execution in ILIAS LMS versions before 9.24, 10.12, and 11.5 lets an authenticated author who holds question-pool (QTI) import rights upload a crafted question-import archive that writes a .htaccess file plus a PHP payload into the web-served image directory, resulting in code execution as the web server user. The defect is an unrestricted file upload (CWE-434) in the QTI image-handling security class ilQtiMatImageSecurity, reached through the standard question import path with no non-default configuration required. Exploitation requires a legitimate, permissioned authoring account rather than anonymous access, no public exploit code has been identified at time of analysis, and vendor-released fixes are available in 9.24, 10.12, and 11.5; instances that limit QTI import rights to vetted staff face materially lower realistic risk.
Path traversal in KodExplorer before 4.55 lets an authenticated low-privileged user bypass the archive-extraction sanitizer and write files anywhere on the server by uploading a ZIP archive containing crafted names such as '....//'. Because the overwritten files can include core JavaScript assets, the flaw chains into stored XSS that can lead to administrator account takeover and, ultimately, remote code execution through unrestricted PHP file upload. Exploitation requires a valid low-privileged account and use of the unzip functionality, so this is a credible, actionable priority rather than a drop-everything emergency; no public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation, while a vendor patch is available in release 4.55.
Stored cross-site scripting and potential remote code execution in HortusFox (hortusfox-web) through version 6.3 allow authenticated users to upload files with client-supplied extensions via the plant attachment feature, which are stored under the web-accessible public/attachments/ directory. Uploaded HTML or SVG files lead to stored XSS when a victim opens them, while uploaded PHP files can execute code on servers where .htaccess restrictions are unenforced, though this RCE path requires a non-default misconfiguration. No public exploit code has been identified at time of analysis, although a public technical write-up demonstrating the stored XSS is referenced. The CVSS 4.0 base score is 7.7 (High), and an independent CVSS 3.1 assessment rates it High with C:H/I:H/A:H.
Unrestricted file upload in the PX-lab Zombify WordPress plugin (versions up to and including 1.7.7) lets remote attackers push a dangerous file type, such as a PHP web shell, into a web-accessible location and execute it on the server. The supplied CVSS vector rates this 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality, integrity and availability with scope change, and the vector indicates unauthenticated exploitation with no user interaction, though the Patchstack-sourced advisory does not itself document the precise access level required and defenders should verify whether any privilege is needed in their configuration. No CISA KEV listing and no public exploit code were identified at time of analysis, so real-world impact is currently gated by whether this niche plugin is deployed and its upload path is reachable; where it is, this is a genuine high-priority issue rather than a high-score-but-low-risk case.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Authenticated file upload in Eimzamip v1.6.4 and v1.6.5 (every release before v1.6.6) allows a low-privilege user to store files of dangerous type because the application fails to validate or restrict uploaded content (CWE-434). Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (score 7.3), remote exploitation requires a valid authenticated session on the product's upload functionality plus a user-interaction step - typically a victim or operator opening or processing the planted file - after which confidentiality and integrity impact is high, while scope remains unchanged. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than a top-tier emergency.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated attackers can recursively delete arbitrary directories - including the WordPress installation root - on sites running the Super Forms - Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.316. The flaw is reachable by sending crafted JSON field declarations to the submit_form function that are not validated against the actual form schema, and it is compounded by an ABSPATH guard that dirname() trivially defeats by stripping the trailing slash. Exploitation is remote, unauthenticated (PR:N) and requires no user interaction, but is gated by a configuration prerequisite: an administrator must have enabled the documented 'Delete files from server after form submissions' setting, without which the vulnerable deletion code path is never reached; no public exploit identified at time of analysis.
Unrestricted file upload in the Super Forms - Drag & Drop Form Builder WordPress plugin (all versions up to and including 6.3.316) lets an attacker write attacker-controlled file types to the server, which can be turned into remote code execution. Exploitation is a two-step chain: an authenticated Subscriber-level user poisons the _super_elements post meta with a crafted extensions string through the super_save_form AJAX handler, which lacks capability and nonce checks, and then the super_upload_files endpoint - which requires no authentication at all - applies that string verbatim as its allowed MIME-type map and accepts an executable file. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the practical barrier being acquisition of a low-privileged account, which is trivial on sites with open registration; no public exploit identified at time of analysis.
Authenticated attackers holding BugTracker.NET administrator privileges can achieve server-side code execution by first reconfiguring the application so that attachments are stored in a web-accessible directory, then uploading an .aspx file that the attachment feature fails to filter by extension. Because the uploaded file lands in a location the web server serves and ASP.NET/IIS will process executable handlers there, requesting its URL runs arbitrary code under the web service account. Exploitation is heavily gated: it requires PR:H administrator access and a non-default storage configuration (reflected as AT:P in the CVSS 4.0 vector), and no public exploit code has been identified at time of analysis; the signals consistently describe this as a low real-world priority issue despite a high CVSS 4.0 base score of 7.5.
A stack-based buffer overflow in ASUS router firmware modules lets an attacker who already holds administrative credentials on the device and is connected to the same local or Wi-Fi network segment execute arbitrary code by uploading a crafted configuration file that exceeds an expected buffer size. The flaw is rated CVSS 4.0 9.3 (Critical) and assessed as CVSS 3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, because successful exploitation yields full compromise of confidentiality, integrity and availability of the router, although the adjacent-network (AV:A) and high-privilege (PR:H) requirements exclude anonymous Internet-wide attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; vendor guidance is available through the ASUS Security Advisory.
Stored cross-site scripting in the Arista CloudVision Fileserver upload API lets an attacker who holds a valid CloudVision account with file-upload privileges persist a malicious payload that executes in another user's browser session. Because the missing input validation allows unsanitized content to be stored and later rendered, a successful hijack of an administrator's web session can yield full account and administrative access, which is why the issue carries a 9.3 CVSS 4.0 base score; the independent assessment concurs (CVSS 3.1 8.0-class impact with S:C). Exploitation is not anonymous - it requires authenticated upload privileges (PR:L) and, critically, active interaction from a victim who must view the stored content (UI:A), so the highest-impact outcome depends on an administrator rendering the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the headline 9.3 should be read with that nuance rather than as an unauthenticated remote compromise.
Stored cross-site scripting / unrestricted file upload in Payload CMS lets an authenticated user with upload permission to an XML-accepting collection store an XML document (plus stylesheet) that executes JavaScript in the Payload origin when another logged-in user opens the file. Affected are all 3.x releases before 3.90.0 and canary/4.x builds before 4.0.0-canary.34, which the vendor fixed in the corresponding 3.90.0 and 4.0.0-canary.34 releases. Exploitation is conditional: it requires a non-default local upload configuration that permits XML/XML-family MIME types (for example via allowRestrictedFileTypes), a valid authenticated upload account, and a second user to open the stored file - there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible-but-conditional threat rather than a drop-everything emergency, though the CVSS 4.0 base score of 8.6 reflects high confidentiality/integrity/availability impact on the Payload origin.
HortusFox versions before 6.2 expose an authenticated remote code execution path through the theme import feature (ThemeModule::startImport): an uploaded ZIP archive is extracted into the public web root before file names, extensions, or content are validated, so an attacker with an administrator account can bundle a PHP payload and an .htaccess file that re-enables PHP execution and then execute arbitrary OS commands as the web-server user by requesting the dropped file under the themes directory. Exploitation is gated by administrator privileges (CVSS PR:H), so practical risk depends on obtaining or compromising an admin account; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor addressed the flaw in the 6.2 release, and the issue is tracked under CWE-434 (unrestricted upload of a file with a dangerous type).
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Arbitrary file upload in the Amentotech Workreap Core WordPress plugin (all versions through 3.4.5) lets an authenticated attacker who holds an Employer or Sales Representative role push attacker-controlled files onto the server, which on a standard WordPress/LAMP stack typically escalates to remote code execution and full site takeover. The issue is scored CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and the scope-change metric reflects that the impact crosses out of the plugin into the underlying host, while the low complexity and lack of user interaction mean an attacker only needs a valid low-privileged account. There is no CISA KEV listing and no public exploit identified at time of analysis, but the practical barrier collapses on sites that allow open self-registration of employer or vendor accounts, making this a genuine high-priority vulnerability that should be patched promptly.
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
Unauthenticated arbitrary file upload in Kognetiks Chatbot for WordPress 2.4.9 and earlier allows remote attackers to upload files to the WordPress site without authentication, potentially leading to code execution if the uploaded file is placed in a web-executable location. The independent assessment confirms a high-priority, genuine vulnerability with remote unauthenticated exploitation, no user interaction, and only the vulnerable plugin being installed and active as a prerequisite. No CISA KEV entry or public exploit code is identified in the provided data, and EPSS is not provided.
Remote code execution in the ACPT (Premium) WordPress plugin affects all versions up to and including 2.0.66, allowing an authenticated attacker with only subscriber-level access to run arbitrary code on the server. The chain works by abusing a REST API form-creation endpoint that performs no capability check, planting a malicious email_settings payload, and then triggering a form submission so the plugin's unsandboxed Twig environment renders attacker-controlled template expressions during email generation. No user interaction is required and no public exploit code has been identified at time of analysis, though the low authentication bar (subscriber) makes it considerably more dangerous on sites with open registration; exploitation is not confirmed actively exploited (no CISA KEV listing), and the vendor changelog points to a fixed release.
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).
Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.
Authenticated users holding editor privileges on wcms through 3.18.0 can turn the media upload API into a remote code execution primitive: the [*:path] parameter of POST /api/v0/media/upload/ is not validated, so an editor can write .php files into a web-served location (including outside the media directory via encoded ../ sequences) and have the web server execute them. The same unvalidated path on DELETE /api/v0/media/[*:path] additionally allows arbitrary file deletion, and the underlying flaw is an unrestricted upload of a dangerous file type (CWE-434) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). Exploitation is not anonymous - a valid editor account is mandatory (PR:L) and code execution further depends on the written PHP landing in a directory the web server executes; at time of analysis there is no CISA KEV entry and no public exploit identified at time of analysis.
Unrestricted file upload in YesWiki before 4.6.7 lets a remote attacker who already holds an administrator account turn a crafted Bazar CSV import into server-side code execution: the import preview fetches a remote .php URL referenced in a file or image field and writes it into the web-accessible files/ directory with no extension or MIME validation, where PHP then executes it. The issue is a classic CWE-434 flaw rated CVSS 8.6 (CVSS:4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and because it requires a high-privilege account plus the Bazar component in use, it is best characterized as a privilege-escalation-to-RCE path rather than an unauthenticated remote compromise. No public exploit was identified at time of analysis, and there is no CISA KEV listing; vendor patching is available in YesWiki 4.6.7.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Unauthenticated arbitrary file read, write, and deletion in the Ninja Forms - File Uploads WordPress plugin (versions up to and including 3.3.34) can be triggered by supplying a malicious file_path through the external Amazon S3 upload flow, enabling remote code execution when the External File Upload (Amazon S3) action is configured. Exploitation is remote and unauthenticated (CVSS 8.1, AC:H) but gated by deployment conditions: the S3 external upload action must be in use, and the read variant additionally requires a form Email action that attaches the uploaded file. No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is not provided, and the main risk is to sites using the gated configuration.
Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.
Authenticated, high-privilege users of Pandora FMS 777 and later can upload arbitrary .phar files through the console's File Manager module and have them executed as PHP on the server, because the module's extension blacklist does not block PHP archive files. Successful exploitation yields full loss of confidentiality, integrity and availability of the Pandora FMS application (CVSS 4.0 base 8.6, High; core vector AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H and no scope change, where the headline score is inflated by the vendor's AU/R/RE/U threat and environmental modifiers). Exploitation requires an authenticated console session with access to the File Manager (PR:H) and no user interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the main exposure limiter is the privileged authentication prerequisite.
Arbitrary PHP code execution is achievable in Pandora FMS version 777 and later by chaining a CSRF-protection bypass with an unrestricted file upload in the Plugin File Manager, allowing an attacker to place and execute a malicious PHP payload on the server. Attackers do not need credentials of their own (CVSS PR:N), but exploitation is not a fire-and-forget network attack: it requires a specific attack condition to hold (AT:P) and a logged-in Pandora FMS administrator to interact with the forged request (UI:A), meaning the victim must be socially engineered into triggering it from an authenticated console session. Successful exploitation yields full confidentiality, integrity, and availability impact on the affected instance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in Pandora FMS (version 777 and later) is reachable through a chained attack in the File Manager module: an attacker abuses missing CSRF protection on the file-upload endpoint to plant an SVG file containing embedded JavaScript, which then executes in the browser context of any user who renders it. Because the affected session cookie is accessible to script, successful rendering lets the attacker exfiltrate an authenticated administrator's session and effectively take over the admin account; the vendor rates this 7.4 (High) under CVSS 4.0 while an independent assessment scores it 7.4-equivalent under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no direct availability impact. The attacker needs no credentials (PR:N) but the chain requires an active administrator to be lured into triggering the forged request (UI:A) and the prerequisite condition of an unrestricted SVG upload path being present (AT:P); there is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this should be treated as a high-priority patching item rather than an emergency incident.
Unauthenticated path traversal in the OpenAI-compatible /v1/files upload endpoint of Langchain-Chatchat 0.3.0 allows remote attackers to write files to arbitrary locations outside the intended openai_files directory by supplying crafted filenames. The published CVSS is 9.1, but an independent assessment re-scores the issue at 8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - because the primitive is a file write rather than a read or direct code execution, so confidentiality is unaffected and availability impact is limited. There is no confirmed active exploitation (CVE-2026-51882 is not in CISA KEV) and no public exploit identified at time of analysis, and with an EPSS score of 0.14% (3rd percentile) real-world urgency is driven mainly by whether the API server is network-reachable and how much filesystem write access the service account has.
Authenticated users holding the backend 'manager' role in yii2-starter-kit through 4.2.0 can upload PHP scripts through the backend file-storage upload action and then request them from the web-accessible storage directory, achieving remote code execution as the web server user. The defect is an unrestricted file upload (CWE-434) with a CVSS 4.0 base score of 8.7 (PR:L, fully consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation is gated on manager-level authentication, on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions, which is the default starter-kit layout. No public exploit code identified at time of analysis, and the practical priority is tempered by the authentication prerequisite and the niche footprint of the product, though the impact is total for any live deployment that meets those preconditions.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Authenticated administrative users of Digiwin EasyFlow .NET can exploit an arbitrary file upload vulnerability to place and execute .NET web shell backdoors, achieving remote code execution on the server. The CVSS 4.0 base score is 8.6, but the high privilege requirement (PR:H) confines risk to insider threats or cases where admin credentials are already compromised. No public exploit or confirmed active exploitation exists at time of analysis.
Unauthenticated arbitrary file upload in the Zella WordPress theme before version 2.6.3 lets remote attackers write arbitrary files - including PHP - into the site by abusing a font upload action that performs no capability or nonce check, yielding full remote code execution with a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every WordPress installation running this theme at a version below 2.6.3 in its default configuration is exposed; no login, user interaction, or non-default setting is required. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but CISA's SSVC assessment flags the flaw as fully automatable with total technical impact, so rapid weaponization should be assumed. The vendor has released a fix in version 2.6.3.
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS file upload endpoint performs no server-side file type validation, letting a PHP payload be written to the web server and then executed. The flaw is network-reachable and requires no user interaction, but the CVSS vector (PR:H) and the independent assessment confirm it is only exploitable by a remote attacker who already holds high-privilege authenticated access to the TMS7/TopHat web application - a default configuration without valid credentials is not vulnerable. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the terminal management system; no public exploit code and no CISA KEV entry were identified at time of analysis, and the deployment base is a niche petroleum/OT terminal management environment.
Remote attackers without authentication can access the HTTPPublishAdapterTestServlet on Hitachi Energy Asset Suite deployments where the test servlet is exposed, allowing configuration file uploads that can disclose sensitive information and compromise configuration integrity. The flaw is CWE-306 missing authentication, rated CVSS 4.0 8.5 (High), with high confidentiality and integrity impact but no availability impact, and exploitation requires user interaction per the CVSS vector (UI:A). Hitachi Energy states the servlet is intended only for non-production testing, so risk is concentrated in production instances that inadvertently retain it; no public exploit identified at time of analysis.
Unauthenticated network attackers can exploit a directory traversal flaw in the file-upload feature of Hitachi Energy RTU500 Series CMU firmware to write or overwrite arbitrary files on the device filesystem, potentially modifying device data or disrupting operation. The issue has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), reflecting high integrity and availability impact with no confidentiality impact. This is a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact, but no public exploit code or confirmed active exploitation was identified at time of analysis, and practical exposure is limited by the typical OT network isolation of RTU500 substation devices.
Remote code execution in Flowring Agentflow 4.0 is possible through the /WebAgenda/download/uploadFile.jsp endpoint, where authenticated low-privilege users can upload a file of dangerous type that the server then executes. Affected deployments are builds prior to 2023/03/24, and exploitation requires a valid application session but no victim interaction; no public exploit has been identified at time of analysis, though the technical impact is severe and warrants urgent patching.
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
Authenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into the Keepalived configuration through the High Availability (HA) configuration workflow, which under the right conditions escalates to arbitrary command execution as root on the DDI Central host. The flaw is network-reachable and low in complexity (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), but it is gated by a mandatory valid operator credential and by the HA/Keepalived feature being present and configurable, so it is not pre-authentication and not self-propagating. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor has published a security advisory at https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12269.html.
Authenticated abuse of the document upload function in eBA Plus Document and Workflow Management System (versions 6.7.141 through 10.0.10) lets a low-privilege user place a Web Shell on the server and, if the uploaded file can be reached through a web-accessible path, run code with the privileges of the web application. The defect is CWE-434 (unrestricted upload of a file with a dangerous type) and carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so valid credentials or a self-registration path are required rather than unauthenticated access, and installations already on 10.0.11 or later are outside the affected range. No public exploit has been identified at time of analysis; TR-CERT (Turkish national CERT) is the reporting and reference source. This is a genuine high-priority issue for organizations running the affected product.
Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but given the low attack complexity and PHP code-execution outcome, any site running the popup RFQ flow should be treated as high priority.
Unauthenticated remote code execution affects GestSup, the PHP-based IT asset and ticket management application, in all versions before 3.2.61. Attackers simply send an email carrying a PHP attachment to a mailbox the GestSup basic IMAP connector monitors; the connector fails to apply its blocked-extension filter during attachment ingestion, writes the file into the web-accessible upload/ticket directory, and the payload executes when requested over HTTP (CWE-434). Exploitation requires the IMAP connector to be configured and actively polling a mailbox (the AT:P precondition in the CVSS 4.0 9.2 vector); deployments without email-to-ticket ingestion are not exposed, and no public exploit was identified at time of analysis.
Remote code execution affects Piwigo photo-gallery installations running any release prior to 16.4.0: an authenticated administrator (CVSS PR:H) can abuse the logo upload in admin/themes_standard_pages.php to store a file whose contents pass MIME validation but whose final extension is taken verbatim from the attacker-supplied filename, so a server-executable file such as a .php script lands in the web-accessible logo directory and runs when requested. The flaw carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) because successful exploitation yields arbitrary command execution with full confidentiality, integrity and availability impact and a scope change, though it only works when the deployment's web server actually executes the chosen extension for files in that directory. No CISA KEV entry and no publicly available exploit code were identified at the time of analysis, and the vendor has shipped an exact fix in version 16.4.0.
Unauthenticated remote code execution in Honeywell PD45 Industrial Printer firmware F10.19.010040 lets any network-reachable attacker upload attacker-controlled files through the web management interface and execute them as malicious files and commands. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects the complete absence of authentication or user interaction required, consistent with CWE-306 missing authentication for a critical function, so a single unauthenticated HTTP request path is enough to gain code execution on the device. Honeywell has released fixed firmware F10.22.030745; no public exploit code has been identified at time of analysis, but exposure is constrained mainly by the fact that these industrial printers typically sit on internal warehouse or manufacturing networks rather than the public internet, meaning an attacker usually needs an existing network foothold or adjacent access first.
Unauthenticated file upload in Laravel-Mediable 7.0.0 and 7.0.1 lets a remote attacker upload a .pht file that passes MediaUploader::verifyExtension() and File::sanitizeFileName(), which is then written to disk and executed as PHP when requested on Apache servers configured with the Debian/Ubuntu default FilesMatch handler, resulting in remote code execution as the web server process. The flaw is an incomplete fix for CVE-2026-49972: the forbidden_extensions list added in config/mediable.php blocks phpt but omits pht, an Apache-recognized PHP extension. Vendor-released patch 7.0.2 closes the gap; no public exploit code was identified at time of analysis, but exploitation is trivial where the upload endpoint is reachable and unauthenticated, so the issue warrants high priority despite the platform-specific precondition.
Arbitrary file upload in Microweber Administration Panel allows an authenticated high-privileged administrator to upload unrestricted files, including executable server-side scripts, resulting in remote code execution and complete system compromise. The vulnerable upload forms are administrative features and require prior administrator-level access, so exploitation is not unauthenticated. There is no public exploit identified at time of analysis; the reported EICAR test-file demonstration underscores the missing validation but is not equivalent to active exploitation.
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.
Authenticated low-privileged members of WuzhiCMS 5.0.0 can convert a routine thumbnail upload into full remote code execution, because the member article thumbnail handler at /index.php?m=member&f=article&v=thumbUpload saves the client-supplied file extension verbatim and writes the file into the web-accessible uploadfile/ directory, where a PHP-enabled web server executes it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms the attacker needs only a valid low-privilege account and no user interaction, while SSVC rates technical impact as total; publicly available exploit code exists, so the only real barrier is obtaining a member login, which is trivial where self-registration is open and a meaningful obstacle where account creation is restricted. There is no CISA KEV entry indicating confirmed active exploitation, and the risk is best characterized as a consistently high-priority, easily automated-adjacent upload flaw rather than a confirmed active campaign.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
Unauthenticated arbitrary file upload in the Web to Print Online Designer WordPress plugin (versions 1.7.0 through before 2.15.0) allows any remote visitor to obtain the token that protects the plugin's upload handler and then push arbitrary files, including PHP scripts, into a web-reachable location - resulting in remote code execution with total confidentiality, integrity, and availability impact (CVSS 9.8). No authentication, user interaction, or non-default configuration is required; the plugin simply fails to validate file type or extension and discloses the upload token to anonymous requesters. Publicly available exploit code exists, so weaponization against exposed installations is a realistic short-term risk, although the vendor (WPScan-reported) has shipped a fix in 2.15.0 and EPSS currently rates near-term exploitation probability low at 0.14% (4th percentile), tracking the plugin's comparatively small install base.
Unrestricted file upload in CuteNews 2.1.2 allows an authenticated user who can reach the Media Manager panel to upload a file of a dangerous type - typically a PHP script - through core/modules/media.php and then request that file to execute arbitrary code in the web application's context; the researcher's disclosure notes this can be driven to a reverse shell and remote server access. The flaw is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning total confidentiality, integrity, and availability impact once triggered, but it is gated behind high privileges: the attacker must already hold a Media Manager-capable (administrative/editor-tier) account. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no vendor-released patch has been identified at time of analysis.
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Unauthenticated path-traversal file writes in the EnergizeLab Eilik and EilikO AI skill upload endpoint allow any remote attacker who can reach the FastAPI AI inference and profiling service to write arbitrary files on the robot's host system by supplying crafted traversal filenames in an upload request. Because the endpoint enforces neither authentication nor path constraints, exploitation is a straightforward, low-complexity primitive that lets an attacker tamper with the AI skill files the robots execute, degrading or subverting robot behavior and causing high integrity and availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-434); confidentiality is assessed as unaffected. The practical limiting factor is network reachability rather than credentials or configuration - these are consumer robots whose service is normally confined to the local network segment, so real-world exposure is materially narrower than the AV:N vector implies, and no public exploit code or confirmed active exploitation was identified at time of analysis (the flaw itself needs no user interaction or non-default toggle once the endpoint is reachable).
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Authentication bypass in FileRise versions before 3.23.0 lets a remote attacker log in as an existing local account - including the built-in administrator - by presenting OIDC claims whose mutable preferred_username value, or an unverified email, collides with that account's local username; the flaw works even when OIDC automatic provisioning is disabled. Successful takeover yields full read, write, and delete control over the file manager and its stored files, consistent with the assessed CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional, not universal: the deployment must be configured for OIDC SSO and the identity provider must allow the colliding claim or omit email_verified, which is what drives the High attack-complexity rating; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vulnerability is fixed in FileRise 3.23.0.
Online second-factor guessing against FileRise releases prior to 3.23.0 is permitted well beyond the intended limit because failed TOTP verification attempts are recorded only in the PHP session rather than in a durable account-wide budget. An attacker who already possesses a valid primary credential (username plus password) for an account with TOTP enabled can abandon the pending login, start a fresh session, or change source address to restore the five-attempt allowance and continue guessing time-based codes indefinitely. Exploitation therefore has a hard precondition - the primary credential - and each guess remains a probabilistic online attempt against a rotating code, but a successful guess yields full account compromise; the vendor addressed the flaw in v3.23.0 and no public exploit code has been identified at time of analysis.
Authorization bypass in FileRise prior to 3.18.0 allows an authenticated, low-privileged user to read - and, when they also hold edit-own permission, modify - files they do not own by exploiting a collision in folder metadata filenames. FileRise flattens logical folder paths into metadata filenames by replacing '/', '\\' and spaces with hyphens, so distinct folders such as team/docs and team-docs resolve to the same <name>_metadata.json file; an attacker who controls one colliding folder and knows the target basename can overwrite the uploader-ownership metadata that read_own and ownership-restricted edit checks rely on, making a victim file appear attacker-owned. The issue is rated CVSS 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) and is fixed in 3.18.0; exploitation requires a multi-user deployment, a crafted colliding folder name, pre-existing read_own access to the target folder and knowledge of the exact victim basename, and no public exploit identified at time of analysis. Single-tenant or single-user installations are effectively unaffected because no second user exists to victimize.
File overwrite in FileRise prior to 3.18.0 allows an unauthenticated visitor who holds a valid upload-enabled shared-folder or upload-only link token - plus any configured share password - to re-upload a file using the exact name of an existing file and silently replace its contents while the original uploader metadata is preserved. The same missing replacement check affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the target file, so the outcome is a high-integrity, no-confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, 8.2). Exploitation requires that an administrator has actually created and shared an upload-capable link and that the attacker knows or guesses the target filename; impact is confined to overwriting existing files, with no data disclosure and no code execution path. No public exploit code was identified at time of analysis, and the vendor-released fix is FileRise 3.18.0.
Unauthenticated administrative account takeover in FileRise versions prior to 3.16.0: because the application treats an empty or missing users.txt as a fresh installation, a remote caller with no credentials can detect that first-run setup has silently reopened and create the next initial administrator account through the setup flow. The empty-user-store condition must first arise from storage loss, truncation, or another failure after setup previously completed (hence the AC:H rating), so reliably-stored, intact installations are not exposed; once that state exists, exploitation requires no authentication and no user interaction (PR:N/UI:N) and yields high confidentiality and integrity impact (CVSS 7.4). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the flaw is trivially reproducible by anyone who notices the exposed setup page.
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid username and password for a TOTP-enabled account to authenticate to the WebDAV endpoint without supplying the second factor, then operate within that account's WebDAV file permissions. The weakness is conditionally gated: the opt-in WebDAV service must have been enabled by an administrator, the targeted account must have TOTP configured, and the attacker must already know the account's primary credentials, which the CVSS vector reflects as authenticated access (PR:L); the normal browser login path was never affected. Rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with high confidentiality and integrity impact and no availability impact; no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in FileRise 3.16.0.
Authentication bypass in FileRise (CWE-290) lets unauthenticated remote attackers impersonate any account - including an administrator - without a password or MFA in deployments prior to 3.16.0 that enable proxy-header authentication (AUTH_BYPASS) and expose the backend port directly. The flaw is that the configured reverse-proxy identity header (X-Remote-User) was trusted without validating that the request actually came from an address in FR_TRUSTED_PROXIES; an attacker who can reach the backend application port therefore simply supplies the header and receives a session for the named account. Exploitation requires proxy-header auth to be enabled, the trusted-proxy check to be absent or ineffective (exactly what 3.16.0 fixes), and a network path to the backend that bypasses the proxy, which is why it is scored AV:N/AC:H/PR:N/UI:N with full confidentiality, integrity, and availability impact (CVSS 3.1: 8.1 High); no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an authenticated back-office user to upload a PHP payload that is written into the web-served public/cache/documents/ directory and executed as the web server user. The flaw exists because FileProcessorService validates the filename exactly as the client sent it, while FileManager::renameFile()/sanitizeFileName() later strips characters outside [a-zA-Z0-9-_.], so a name such as 'report.php ' survives validation but is stored as the executable 'report.php'. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires a valid administrative account with access to the document-upload feature; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.1.2 and 3.2.1.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated multipart uploads to the LogicalDOC Community Edition /upload endpoint (through version 9.3) let remote attackers write files into application temporary directories that are never cleaned up, exhausting server disk space and degrading or halting the document management service. The UploadServlet accepts file parts without a valid session and imposes no limit on the number of parts per request, so no credentials, user interaction, or non-default configuration are needed - only network reachability to the endpoint. Impact is confined to availability (integrity and confidentiality are unaffected, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector), no public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated arbitrary file upload in the Tailored Tools plugin for WordPress (versions up to and including 3.0.3) allows remote attackers to write attacker-controlled files to the web server, which can be escalated to remote code execution where the uploaded file type is executable. The vulnerability is rated CVSS 9.0 (assessed vector AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) and requires no authentication or user interaction, though the high attack-complexity component indicates a non-trivial precondition such as path/filename guessing or a specific plugin configuration that must be satisfied for a successful upload. No public exploit code was identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; real-world exposure is limited mainly by the plugin's narrow deployment footprint.
Authenticated arbitrary file upload in the CodeBard Help Desk WordPress plugin (versions up to and including 1.1.2) lets any logged-in user holding only a subscriber-level account push an executable PHP file onto the server through the plugin's ticket/attachment upload path, which typically converts into full remote code execution on the WordPress host. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - the scope change reflects that a low-privileged plugin user can compromise the whole site, not just the plugin - and requires no administrator rights and no victim interaction, though it does require an account on the target site (trivially obtained wherever open or self-service registration is enabled). At time of analysis there is no CISA KEV entry and no public exploit code identified for this issue; the practical urgency therefore turns on how easily an attacker can register a subscriber account on the target installation. This is a genuine high-priority issue, not a CVSS-inflated one.
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
Remote code execution in ILIAS LMS versions before 9.24, 10.12, and 11.5 lets an authenticated author who holds question-pool (QTI) import rights upload a crafted question-import archive that writes a .htaccess file plus a PHP payload into the web-served image directory, resulting in code execution as the web server user. The defect is an unrestricted file upload (CWE-434) in the QTI image-handling security class ilQtiMatImageSecurity, reached through the standard question import path with no non-default configuration required. Exploitation requires a legitimate, permissioned authoring account rather than anonymous access, no public exploit code has been identified at time of analysis, and vendor-released fixes are available in 9.24, 10.12, and 11.5; instances that limit QTI import rights to vetted staff face materially lower realistic risk.
Path traversal in KodExplorer before 4.55 lets an authenticated low-privileged user bypass the archive-extraction sanitizer and write files anywhere on the server by uploading a ZIP archive containing crafted names such as '....//'. Because the overwritten files can include core JavaScript assets, the flaw chains into stored XSS that can lead to administrator account takeover and, ultimately, remote code execution through unrestricted PHP file upload. Exploitation requires a valid low-privileged account and use of the unzip functionality, so this is a credible, actionable priority rather than a drop-everything emergency; no public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation, while a vendor patch is available in release 4.55.
Stored cross-site scripting and potential remote code execution in HortusFox (hortusfox-web) through version 6.3 allow authenticated users to upload files with client-supplied extensions via the plant attachment feature, which are stored under the web-accessible public/attachments/ directory. Uploaded HTML or SVG files lead to stored XSS when a victim opens them, while uploaded PHP files can execute code on servers where .htaccess restrictions are unenforced, though this RCE path requires a non-default misconfiguration. No public exploit code has been identified at time of analysis, although a public technical write-up demonstrating the stored XSS is referenced. The CVSS 4.0 base score is 7.7 (High), and an independent CVSS 3.1 assessment rates it High with C:H/I:H/A:H.
Unrestricted file upload in the PX-lab Zombify WordPress plugin (versions up to and including 1.7.7) lets remote attackers push a dangerous file type, such as a PHP web shell, into a web-accessible location and execute it on the server. The supplied CVSS vector rates this 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality, integrity and availability with scope change, and the vector indicates unauthenticated exploitation with no user interaction, though the Patchstack-sourced advisory does not itself document the precise access level required and defenders should verify whether any privilege is needed in their configuration. No CISA KEV listing and no public exploit code were identified at time of analysis, so real-world impact is currently gated by whether this niche plugin is deployed and its upload path is reachable; where it is, this is a genuine high-priority issue rather than a high-score-but-low-risk case.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Authenticated file upload in Eimzamip v1.6.4 and v1.6.5 (every release before v1.6.6) allows a low-privilege user to store files of dangerous type because the application fails to validate or restrict uploaded content (CWE-434). Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (score 7.3), remote exploitation requires a valid authenticated session on the product's upload functionality plus a user-interaction step - typically a victim or operator opening or processing the planted file - after which confidentiality and integrity impact is high, while scope remains unchanged. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than a top-tier emergency.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated attackers can recursively delete arbitrary directories - including the WordPress installation root - on sites running the Super Forms - Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.316. The flaw is reachable by sending crafted JSON field declarations to the submit_form function that are not validated against the actual form schema, and it is compounded by an ABSPATH guard that dirname() trivially defeats by stripping the trailing slash. Exploitation is remote, unauthenticated (PR:N) and requires no user interaction, but is gated by a configuration prerequisite: an administrator must have enabled the documented 'Delete files from server after form submissions' setting, without which the vulnerable deletion code path is never reached; no public exploit identified at time of analysis.
Unrestricted file upload in the Super Forms - Drag & Drop Form Builder WordPress plugin (all versions up to and including 6.3.316) lets an attacker write attacker-controlled file types to the server, which can be turned into remote code execution. Exploitation is a two-step chain: an authenticated Subscriber-level user poisons the _super_elements post meta with a crafted extensions string through the super_save_form AJAX handler, which lacks capability and nonce checks, and then the super_upload_files endpoint - which requires no authentication at all - applies that string verbatim as its allowed MIME-type map and accepts an executable file. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the practical barrier being acquisition of a low-privileged account, which is trivial on sites with open registration; no public exploit identified at time of analysis.
Authenticated attackers holding BugTracker.NET administrator privileges can achieve server-side code execution by first reconfiguring the application so that attachments are stored in a web-accessible directory, then uploading an .aspx file that the attachment feature fails to filter by extension. Because the uploaded file lands in a location the web server serves and ASP.NET/IIS will process executable handlers there, requesting its URL runs arbitrary code under the web service account. Exploitation is heavily gated: it requires PR:H administrator access and a non-default storage configuration (reflected as AT:P in the CVSS 4.0 vector), and no public exploit code has been identified at time of analysis; the signals consistently describe this as a low real-world priority issue despite a high CVSS 4.0 base score of 7.5.
A stack-based buffer overflow in ASUS router firmware modules lets an attacker who already holds administrative credentials on the device and is connected to the same local or Wi-Fi network segment execute arbitrary code by uploading a crafted configuration file that exceeds an expected buffer size. The flaw is rated CVSS 4.0 9.3 (Critical) and assessed as CVSS 3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, because successful exploitation yields full compromise of confidentiality, integrity and availability of the router, although the adjacent-network (AV:A) and high-privilege (PR:H) requirements exclude anonymous Internet-wide attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; vendor guidance is available through the ASUS Security Advisory.
Stored cross-site scripting in the Arista CloudVision Fileserver upload API lets an attacker who holds a valid CloudVision account with file-upload privileges persist a malicious payload that executes in another user's browser session. Because the missing input validation allows unsanitized content to be stored and later rendered, a successful hijack of an administrator's web session can yield full account and administrative access, which is why the issue carries a 9.3 CVSS 4.0 base score; the independent assessment concurs (CVSS 3.1 8.0-class impact with S:C). Exploitation is not anonymous - it requires authenticated upload privileges (PR:L) and, critically, active interaction from a victim who must view the stored content (UI:A), so the highest-impact outcome depends on an administrator rendering the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the headline 9.3 should be read with that nuance rather than as an unauthenticated remote compromise.
Stored cross-site scripting / unrestricted file upload in Payload CMS lets an authenticated user with upload permission to an XML-accepting collection store an XML document (plus stylesheet) that executes JavaScript in the Payload origin when another logged-in user opens the file. Affected are all 3.x releases before 3.90.0 and canary/4.x builds before 4.0.0-canary.34, which the vendor fixed in the corresponding 3.90.0 and 4.0.0-canary.34 releases. Exploitation is conditional: it requires a non-default local upload configuration that permits XML/XML-family MIME types (for example via allowRestrictedFileTypes), a valid authenticated upload account, and a second user to open the stored file - there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible-but-conditional threat rather than a drop-everything emergency, though the CVSS 4.0 base score of 8.6 reflects high confidentiality/integrity/availability impact on the Payload origin.
HortusFox versions before 6.2 expose an authenticated remote code execution path through the theme import feature (ThemeModule::startImport): an uploaded ZIP archive is extracted into the public web root before file names, extensions, or content are validated, so an attacker with an administrator account can bundle a PHP payload and an .htaccess file that re-enables PHP execution and then execute arbitrary OS commands as the web-server user by requesting the dropped file under the themes directory. Exploitation is gated by administrator privileges (CVSS PR:H), so practical risk depends on obtaining or compromising an admin account; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor addressed the flaw in the 6.2 release, and the issue is tracked under CWE-434 (unrestricted upload of a file with a dangerous type).
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Arbitrary file upload in the Amentotech Workreap Core WordPress plugin (all versions through 3.4.5) lets an authenticated attacker who holds an Employer or Sales Representative role push attacker-controlled files onto the server, which on a standard WordPress/LAMP stack typically escalates to remote code execution and full site takeover. The issue is scored CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and the scope-change metric reflects that the impact crosses out of the plugin into the underlying host, while the low complexity and lack of user interaction mean an attacker only needs a valid low-privileged account. There is no CISA KEV listing and no public exploit identified at time of analysis, but the practical barrier collapses on sites that allow open self-registration of employer or vendor accounts, making this a genuine high-priority vulnerability that should be patched promptly.
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
Unauthenticated arbitrary file upload in Kognetiks Chatbot for WordPress 2.4.9 and earlier allows remote attackers to upload files to the WordPress site without authentication, potentially leading to code execution if the uploaded file is placed in a web-executable location. The independent assessment confirms a high-priority, genuine vulnerability with remote unauthenticated exploitation, no user interaction, and only the vulnerable plugin being installed and active as a prerequisite. No CISA KEV entry or public exploit code is identified in the provided data, and EPSS is not provided.
Remote code execution in the ACPT (Premium) WordPress plugin affects all versions up to and including 2.0.66, allowing an authenticated attacker with only subscriber-level access to run arbitrary code on the server. The chain works by abusing a REST API form-creation endpoint that performs no capability check, planting a malicious email_settings payload, and then triggering a form submission so the plugin's unsandboxed Twig environment renders attacker-controlled template expressions during email generation. No user interaction is required and no public exploit code has been identified at time of analysis, though the low authentication bar (subscriber) makes it considerably more dangerous on sites with open registration; exploitation is not confirmed actively exploited (no CISA KEV listing), and the vendor changelog points to a fixed release.
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).
Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.
Authenticated users holding editor privileges on wcms through 3.18.0 can turn the media upload API into a remote code execution primitive: the [*:path] parameter of POST /api/v0/media/upload/ is not validated, so an editor can write .php files into a web-served location (including outside the media directory via encoded ../ sequences) and have the web server execute them. The same unvalidated path on DELETE /api/v0/media/[*:path] additionally allows arbitrary file deletion, and the underlying flaw is an unrestricted upload of a dangerous file type (CWE-434) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). Exploitation is not anonymous - a valid editor account is mandatory (PR:L) and code execution further depends on the written PHP landing in a directory the web server executes; at time of analysis there is no CISA KEV entry and no public exploit identified at time of analysis.
Unrestricted file upload in YesWiki before 4.6.7 lets a remote attacker who already holds an administrator account turn a crafted Bazar CSV import into server-side code execution: the import preview fetches a remote .php URL referenced in a file or image field and writes it into the web-accessible files/ directory with no extension or MIME validation, where PHP then executes it. The issue is a classic CWE-434 flaw rated CVSS 8.6 (CVSS:4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and because it requires a high-privilege account plus the Bazar component in use, it is best characterized as a privilege-escalation-to-RCE path rather than an unauthenticated remote compromise. No public exploit was identified at time of analysis, and there is no CISA KEV listing; vendor patching is available in YesWiki 4.6.7.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Unauthenticated arbitrary file read, write, and deletion in the Ninja Forms - File Uploads WordPress plugin (versions up to and including 3.3.34) can be triggered by supplying a malicious file_path through the external Amazon S3 upload flow, enabling remote code execution when the External File Upload (Amazon S3) action is configured. Exploitation is remote and unauthenticated (CVSS 8.1, AC:H) but gated by deployment conditions: the S3 external upload action must be in use, and the read variant additionally requires a form Email action that attaches the uploaded file. No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is not provided, and the main risk is to sites using the gated configuration.
Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.
Authenticated, high-privilege users of Pandora FMS 777 and later can upload arbitrary .phar files through the console's File Manager module and have them executed as PHP on the server, because the module's extension blacklist does not block PHP archive files. Successful exploitation yields full loss of confidentiality, integrity and availability of the Pandora FMS application (CVSS 4.0 base 8.6, High; core vector AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H and no scope change, where the headline score is inflated by the vendor's AU/R/RE/U threat and environmental modifiers). Exploitation requires an authenticated console session with access to the File Manager (PR:H) and no user interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the main exposure limiter is the privileged authentication prerequisite.
Arbitrary PHP code execution is achievable in Pandora FMS version 777 and later by chaining a CSRF-protection bypass with an unrestricted file upload in the Plugin File Manager, allowing an attacker to place and execute a malicious PHP payload on the server. Attackers do not need credentials of their own (CVSS PR:N), but exploitation is not a fire-and-forget network attack: it requires a specific attack condition to hold (AT:P) and a logged-in Pandora FMS administrator to interact with the forged request (UI:A), meaning the victim must be socially engineered into triggering it from an authenticated console session. Successful exploitation yields full confidentiality, integrity, and availability impact on the affected instance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in Pandora FMS (version 777 and later) is reachable through a chained attack in the File Manager module: an attacker abuses missing CSRF protection on the file-upload endpoint to plant an SVG file containing embedded JavaScript, which then executes in the browser context of any user who renders it. Because the affected session cookie is accessible to script, successful rendering lets the attacker exfiltrate an authenticated administrator's session and effectively take over the admin account; the vendor rates this 7.4 (High) under CVSS 4.0 while an independent assessment scores it 7.4-equivalent under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no direct availability impact. The attacker needs no credentials (PR:N) but the chain requires an active administrator to be lured into triggering the forged request (UI:A) and the prerequisite condition of an unrestricted SVG upload path being present (AT:P); there is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this should be treated as a high-priority patching item rather than an emergency incident.
Unauthenticated path traversal in the OpenAI-compatible /v1/files upload endpoint of Langchain-Chatchat 0.3.0 allows remote attackers to write files to arbitrary locations outside the intended openai_files directory by supplying crafted filenames. The published CVSS is 9.1, but an independent assessment re-scores the issue at 8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - because the primitive is a file write rather than a read or direct code execution, so confidentiality is unaffected and availability impact is limited. There is no confirmed active exploitation (CVE-2026-51882 is not in CISA KEV) and no public exploit identified at time of analysis, and with an EPSS score of 0.14% (3rd percentile) real-world urgency is driven mainly by whether the API server is network-reachable and how much filesystem write access the service account has.
Authenticated users holding the backend 'manager' role in yii2-starter-kit through 4.2.0 can upload PHP scripts through the backend file-storage upload action and then request them from the web-accessible storage directory, achieving remote code execution as the web server user. The defect is an unrestricted file upload (CWE-434) with a CVSS 4.0 base score of 8.7 (PR:L, fully consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation is gated on manager-level authentication, on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions, which is the default starter-kit layout. No public exploit code identified at time of analysis, and the practical priority is tempered by the authentication prerequisite and the niche footprint of the product, though the impact is total for any live deployment that meets those preconditions.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Authenticated administrative users of Digiwin EasyFlow .NET can exploit an arbitrary file upload vulnerability to place and execute .NET web shell backdoors, achieving remote code execution on the server. The CVSS 4.0 base score is 8.6, but the high privilege requirement (PR:H) confines risk to insider threats or cases where admin credentials are already compromised. No public exploit or confirmed active exploitation exists at time of analysis.
Unauthenticated arbitrary file upload in the Zella WordPress theme before version 2.6.3 lets remote attackers write arbitrary files - including PHP - into the site by abusing a font upload action that performs no capability or nonce check, yielding full remote code execution with a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every WordPress installation running this theme at a version below 2.6.3 in its default configuration is exposed; no login, user interaction, or non-default setting is required. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but CISA's SSVC assessment flags the flaw as fully automatable with total technical impact, so rapid weaponization should be assumed. The vendor has released a fix in version 2.6.3.
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS file upload endpoint performs no server-side file type validation, letting a PHP payload be written to the web server and then executed. The flaw is network-reachable and requires no user interaction, but the CVSS vector (PR:H) and the independent assessment confirm it is only exploitable by a remote attacker who already holds high-privilege authenticated access to the TMS7/TopHat web application - a default configuration without valid credentials is not vulnerable. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the terminal management system; no public exploit code and no CISA KEV entry were identified at time of analysis, and the deployment base is a niche petroleum/OT terminal management environment.
Remote attackers without authentication can access the HTTPPublishAdapterTestServlet on Hitachi Energy Asset Suite deployments where the test servlet is exposed, allowing configuration file uploads that can disclose sensitive information and compromise configuration integrity. The flaw is CWE-306 missing authentication, rated CVSS 4.0 8.5 (High), with high confidentiality and integrity impact but no availability impact, and exploitation requires user interaction per the CVSS vector (UI:A). Hitachi Energy states the servlet is intended only for non-production testing, so risk is concentrated in production instances that inadvertently retain it; no public exploit identified at time of analysis.
Unauthenticated network attackers can exploit a directory traversal flaw in the file-upload feature of Hitachi Energy RTU500 Series CMU firmware to write or overwrite arbitrary files on the device filesystem, potentially modifying device data or disrupting operation. The issue has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), reflecting high integrity and availability impact with no confidentiality impact. This is a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact, but no public exploit code or confirmed active exploitation was identified at time of analysis, and practical exposure is limited by the typical OT network isolation of RTU500 substation devices.
Remote code execution in Flowring Agentflow 4.0 is possible through the /WebAgenda/download/uploadFile.jsp endpoint, where authenticated low-privilege users can upload a file of dangerous type that the server then executes. Affected deployments are builds prior to 2023/03/24, and exploitation requires a valid application session but no victim interaction; no public exploit has been identified at time of analysis, though the technical impact is severe and warrants urgent patching.
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
Authenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into the Keepalived configuration through the High Availability (HA) configuration workflow, which under the right conditions escalates to arbitrary command execution as root on the DDI Central host. The flaw is network-reachable and low in complexity (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), but it is gated by a mandatory valid operator credential and by the HA/Keepalived feature being present and configurable, so it is not pre-authentication and not self-propagating. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor has published a security advisory at https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12269.html.
Authenticated abuse of the document upload function in eBA Plus Document and Workflow Management System (versions 6.7.141 through 10.0.10) lets a low-privilege user place a Web Shell on the server and, if the uploaded file can be reached through a web-accessible path, run code with the privileges of the web application. The defect is CWE-434 (unrestricted upload of a file with a dangerous type) and carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so valid credentials or a self-registration path are required rather than unauthenticated access, and installations already on 10.0.11 or later are outside the affected range. No public exploit has been identified at time of analysis; TR-CERT (Turkish national CERT) is the reporting and reference source. This is a genuine high-priority issue for organizations running the affected product.
Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but given the low attack complexity and PHP code-execution outcome, any site running the popup RFQ flow should be treated as high priority.
Unauthenticated remote code execution affects GestSup, the PHP-based IT asset and ticket management application, in all versions before 3.2.61. Attackers simply send an email carrying a PHP attachment to a mailbox the GestSup basic IMAP connector monitors; the connector fails to apply its blocked-extension filter during attachment ingestion, writes the file into the web-accessible upload/ticket directory, and the payload executes when requested over HTTP (CWE-434). Exploitation requires the IMAP connector to be configured and actively polling a mailbox (the AT:P precondition in the CVSS 4.0 9.2 vector); deployments without email-to-ticket ingestion are not exposed, and no public exploit was identified at time of analysis.
Remote code execution affects Piwigo photo-gallery installations running any release prior to 16.4.0: an authenticated administrator (CVSS PR:H) can abuse the logo upload in admin/themes_standard_pages.php to store a file whose contents pass MIME validation but whose final extension is taken verbatim from the attacker-supplied filename, so a server-executable file such as a .php script lands in the web-accessible logo directory and runs when requested. The flaw carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) because successful exploitation yields arbitrary command execution with full confidentiality, integrity and availability impact and a scope change, though it only works when the deployment's web server actually executes the chosen extension for files in that directory. No CISA KEV entry and no publicly available exploit code were identified at the time of analysis, and the vendor has shipped an exact fix in version 16.4.0.
Unauthenticated remote code execution in Honeywell PD45 Industrial Printer firmware F10.19.010040 lets any network-reachable attacker upload attacker-controlled files through the web management interface and execute them as malicious files and commands. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects the complete absence of authentication or user interaction required, consistent with CWE-306 missing authentication for a critical function, so a single unauthenticated HTTP request path is enough to gain code execution on the device. Honeywell has released fixed firmware F10.22.030745; no public exploit code has been identified at time of analysis, but exposure is constrained mainly by the fact that these industrial printers typically sit on internal warehouse or manufacturing networks rather than the public internet, meaning an attacker usually needs an existing network foothold or adjacent access first.
Unauthenticated file upload in Laravel-Mediable 7.0.0 and 7.0.1 lets a remote attacker upload a .pht file that passes MediaUploader::verifyExtension() and File::sanitizeFileName(), which is then written to disk and executed as PHP when requested on Apache servers configured with the Debian/Ubuntu default FilesMatch handler, resulting in remote code execution as the web server process. The flaw is an incomplete fix for CVE-2026-49972: the forbidden_extensions list added in config/mediable.php blocks phpt but omits pht, an Apache-recognized PHP extension. Vendor-released patch 7.0.2 closes the gap; no public exploit code was identified at time of analysis, but exploitation is trivial where the upload endpoint is reachable and unauthenticated, so the issue warrants high priority despite the platform-specific precondition.
Arbitrary file upload in Microweber Administration Panel allows an authenticated high-privileged administrator to upload unrestricted files, including executable server-side scripts, resulting in remote code execution and complete system compromise. The vulnerable upload forms are administrative features and require prior administrator-level access, so exploitation is not unauthenticated. There is no public exploit identified at time of analysis; the reported EICAR test-file demonstration underscores the missing validation but is not equivalent to active exploitation.
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.
Authenticated low-privileged members of WuzhiCMS 5.0.0 can convert a routine thumbnail upload into full remote code execution, because the member article thumbnail handler at /index.php?m=member&f=article&v=thumbUpload saves the client-supplied file extension verbatim and writes the file into the web-accessible uploadfile/ directory, where a PHP-enabled web server executes it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms the attacker needs only a valid low-privilege account and no user interaction, while SSVC rates technical impact as total; publicly available exploit code exists, so the only real barrier is obtaining a member login, which is trivial where self-registration is open and a meaningful obstacle where account creation is restricted. There is no CISA KEV entry indicating confirmed active exploitation, and the risk is best characterized as a consistently high-priority, easily automated-adjacent upload flaw rather than a confirmed active campaign.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
Unauthenticated arbitrary file upload in the Web to Print Online Designer WordPress plugin (versions 1.7.0 through before 2.15.0) allows any remote visitor to obtain the token that protects the plugin's upload handler and then push arbitrary files, including PHP scripts, into a web-reachable location - resulting in remote code execution with total confidentiality, integrity, and availability impact (CVSS 9.8). No authentication, user interaction, or non-default configuration is required; the plugin simply fails to validate file type or extension and discloses the upload token to anonymous requesters. Publicly available exploit code exists, so weaponization against exposed installations is a realistic short-term risk, although the vendor (WPScan-reported) has shipped a fix in 2.15.0 and EPSS currently rates near-term exploitation probability low at 0.14% (4th percentile), tracking the plugin's comparatively small install base.
Unrestricted file upload in CuteNews 2.1.2 allows an authenticated user who can reach the Media Manager panel to upload a file of a dangerous type - typically a PHP script - through core/modules/media.php and then request that file to execute arbitrary code in the web application's context; the researcher's disclosure notes this can be driven to a reverse shell and remote server access. The flaw is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning total confidentiality, integrity, and availability impact once triggered, but it is gated behind high privileges: the attacker must already hold a Media Manager-capable (administrative/editor-tier) account. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no vendor-released patch has been identified at time of analysis.