File Upload
Monthly
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0.3.683, caused by an unrestricted file upload (CWE-434) that lets an attacker place a file of a dangerous type on the server. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are required, and the high integrity impact (I:H) reflects the ability to modify or replace server-side content with attacker-controlled code. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and network reachability of the WMS administrative web interface make rapid patching the correct posture.
We need answer JSON only. Let's analyze. CVE-2026-81239 Dell Wyse Management Suite versions prior to 2605.0.3.683 unrestricted upload dangerous file type. Unauthenticated remote access, RCE. CVSS 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. CWE-434. CPE dell wyse_management_suite. Tags Dell, File Upload, Wyse Management Suite. Reference Dell advisory. No EPSS/KEV provided. Not in KEV. POC unknown. Patch likely version 2605.0.3.683. Need produce fields. Be careful: "unauthenticated" allowed because CVSS PR:N. Description says unauthenticated. Exploitation status: no public exploit identified at time of analysis (no POC, no KEV). Patch status maybe vendor advisory but exact fix version from description? Yes fixed in 2605.0.3.683? "versions prior to 2605.0.3.683 contain..." implies upgrade to 2605.0.3.683. So "Vendor-released patch: 2605.0.3.683" perhaps. But input didn't explicitly say patch available? It says versions prior to contain vulnerability, Dell advisory security update. We can say Vendor-released patch: 2605.0.3.683. Maybe okay. But precision: if input includes exact fix version. "versions prior to 2605.0.3.683" is exact fix threshold. So yes. Product name: "Dell Wyse Management Suite" maybe 4 words? They said 1-3 words ONLY. "Wyse Management Suite" is 3 words. Or "Dell Wyse Management" no. Use "Wyse Management Suite" (Dell vendor omitted but product). Maybe "Dell Wyse Management Suite" is 4 words. Use "Wyse Management Suite". Summary original. Must not start with A vulnerability etc. Start impact verb and product. "Unauthenticated remote file upload in Dell Wyse Management Suite (versions before 2605.0.3.683) allows attackers to upload dangerous file types and achieve remote code execution." Mention no KEV POC? "No public exploit identified at time of analysis." EPSS not provided. Okay. Technical context: CWE-434 unrestricted upload dangerous type. Dell WMS is endpoint management for Wyse thin clients, often admin portal. File upload endpoint lacks file t
Unauthenticated remote attackers can upload files of dangerous type to Dell Wyse Management Suite deployments running versions prior to 2605.0.3.683, because the console fails to restrict uploaded file types (CWE-434), which allows a crafted payload such as a web shell to be placed and executed on the server. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are required — only network reachability to the WMS web interface. Neither CISA KEV listing nor public exploit code has been identified in the supplied intelligence, so at time of analysis this is a severe but not yet confirmed-exploited issue.
Arbitrary code execution is possible on Contec CAN 2.0B series communication converter units (CAN-2-WF wireless LAN and CAN-2-USB USB variants) via unrestricted file upload. A remote attacker holding high-privilege credentials can upload a specially crafted file to the device's web interface, resulting in code execution directly on the embedded unit. Reported by JPCERT/CC with a vendor advisory; no public exploit or CISA KEV listing identified at time of analysis.
Arbitrary command execution via unrestricted file upload affects CONTEC's CONPROSYS TM Series industrial controllers (CPS-TM341G5MB-ADSC1-931, CPS-TM341MB-ADSC1-931, and CPS-TM341GMB-ADSC1-931). A remote attacker holding valid credentials can upload a specially crafted file through the device's management interface, causing the underlying system to execute attacker-controlled commands. The CVSS 4.0 score of 8.7 reflects full confidentiality, integrity, and availability compromise of the vulnerable system, with authentication as the sole barrier to exploitation. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the 'WP images upload on piclect' WordPress plugin (versions through 1.0) arises because the plugin writes uploaded files to a publicly accessible directory without validating the filename or MIME/content type. Any remote attacker can upload a PHP file and request it directly to run arbitrary code as the web server. Reported by WPScan with a maximal 9.8 CVSS; no public exploit code is identified at time of analysis and EPSS remains low at 0.16%.
Remote code execution in the DS Ad Rotator WordPress plugin (all versions through 0.8) allows unauthenticated attackers to upload arbitrary files, including PHP scripts, because the image upload handler enforces no capability check, no nonce verification, and no file-type validation. Any anonymous visitor can drop a web shell into a web-accessible directory and execute it for full server compromise. WPScan reports the flaw with a public advisory; no public exploit is identified at time of analysis and EPSS risk is low (0.20%), but the exploitation technique is trivial and well understood.
Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.
Authenticated remote code execution is possible in BurgerEditor versions 3.2.0-3.4.0 (and 2.28.0-2.30.0 per EUVD data) via unrestricted file upload, allowing a logged-in attacker to upload arbitrary PHP files and execute server-side code. The vulnerability stems from insufficient validation of uploaded file types (CWE-434), enabling placement of attacker-controlled executables in a web-accessible location. No public exploit code or active exploitation has been identified at time of analysis, though the attack is straightforward once authentication is obtained.
Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch.
Arbitrary file upload with path traversal in LZ-litchi 1.0.0 lets remote unauthenticated attackers write attacker-controlled files to locations outside the intended storage directory by manipulating the 'directory' parameter of POST /app-api/infra/file/upload. Because uploaded content and destination path are both attacker-controlled, an attacker can plant a web-executable payload and achieve code execution on the host. No public exploit is confirmed beyond the referenced GitHub issue writeup, and EPSS remains low (0.18%) despite the maximal CVSS of 9.8.
Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated remote code execution in Voltronic Power SNMP Web Pro 1.1 lets remote attackers gain root on the device by POSTing a crafted tar archive to the upload.cgi firmware-update endpoint. Because the archive is extracted into a privileged directory and its contents executed as root without any credential check, a single request yields full system compromise. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC); this is not yet listed in CISA KEV.
Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in AppNitro MachForm v30 permits unauthenticated remote attackers to achieve code execution by uploading a crafted .phar (PHP Archive) file through the application's file upload functionality. Because the application fails to block .phar extensions alongside conventional dangerous types like .php, an attacker can cause the PHP runtime to execute attacker-supplied code upon accessing the uploaded file. A public proof-of-concept is available on GitHub and a write-up is hosted on PacketStorm Security, raising practical exploitability above the low EPSS score would suggest.
Arbitrary file upload via the `/cgi-bin/ugwupload.cgi` endpoint in MBS-Solutions X-Serie Gateway firmware V6_00_05 permits an authenticated administrator to write files of arbitrary content to hardcoded filesystem paths. The CWE-434 flaw can be used to plant backdoors, overwrite critical device configuration, or corrupt the operating environment, potentially resulting in full device compromise. A public proof-of-concept repository exists on GitHub (SilviaMun/vulnerability-research), though current EPSS exploitation probability is low at 0.24% (15th percentile), consistent with a niche embedded device with limited deployment footprint.
Remote code execution in easyadmin v2.0.2.2 lets attackers with access to the background management interface upload a crafted file of a dangerous type (e.g. a PHP webshell) and execute arbitrary code, gaining server-level privileges. The flaw is a classic unrestricted file upload (CWE-434) in an admin-only feature; the description specifies authenticated access despite the provided CVSS vector marking it as requiring no privileges. EPSS is low (0.24%, 15th percentile) and there is no evidence of active exploitation, though a researcher issue writeup is referenced.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
Unauthenticated arbitrary file upload in GeoNetwork prior to versions 4.4.12 and 4.2.17 allows remote attackers to write malicious XSLT or ZIP formatter files directly to the server's formatter directory without any authorization check. Because GeoNetwork processes uploaded `.xsl` formatter files server-side via a Java XSLT engine when rendering metadata records, attackers can weaponize this upload into a remote code execution chain by embedding Java extension function calls within the XSLT payload. No public exploit has been confirmed at time of analysis, but The Hacker News coverage explicitly frames this as unauthenticated RCE, and the exploitation path (malicious XSLT to Java extension-function execution) is a well-documented Java attack technique.
Remote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authenticated administrator to upload a PHP webshell that, once processed, runs arbitrary code as the web-service account. The upload routine trusts the client-supplied filename and never validates file content or securely restricts extensions (CWE-434), so a benign-looking CSV import becomes a code-execution primitive. Disclosed via INCIBE as part of a multi-vulnerability advisory for Ocsreports; no public exploit identified at time of analysis, and no EPSS or KEV signal is present in the input.
Authenticated administrators in UnoPim before version 2.1.5 can achieve full server-side remote code execution by uploading arbitrary PHP files through the TinyMCE image upload endpoint, which performs no file extension or MIME type validation before writing files to the public storage disk. The server response discloses the uploaded file's URL, enabling direct invocation of the web shell and arbitrary OS command execution under the web server process context. A publicly available proof-of-concept and vendor-released patch (v2.1.5) both exist; no CISA KEV listing was identified at time of analysis.
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely.
Arbitrary code execution in Mozilla Thunderbird before 154 (and before ESR 153.2) on Windows allows a crafted calendar (iCalendar) invitation to attach a file:// URI that points at a local or network-hosted executable, bypassing Thunderbird's normal blocking of executable attachments. When the new invitation display is enabled the attachment can also be shown under a misleading, benign-looking filename. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; EPSS is low at 0.15% (5th percentile).
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in Master Addons for Elementor (all versions through 3.1.9) enables WordPress users with editor-level access to achieve remote code execution by exploiting a misconfigured AJAX authorization check. The upload_template_kit() handler incorrectly enforces only the upload_files capability-held by editors by default-rather than the manage_options capability required by every sibling handler, and performs no file-type filtering on content extracted from uploaded ZIP archives, allowing PHP webshells and other executable files to land on the server. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and clear code-level proof in the plugin SVN repository make this a high-priority remediation for any multi-user WordPress site running Elementor.
Unauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, versions up to and including 4.4.1, allows remote attackers to plant executable files on the server and potentially achieve remote code execution. The flaw stems from missing file-type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints, so no login is required. Reported by Wordfence and carrying a CVSS of 9.8; no public exploit identified at time of analysis.
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. Rated CVSS 10.0 with a scope-change vector; no public exploit identified at time of analysis and it is not listed in CISA KEV, though the class of bug is trivially weaponizable.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
File upload restriction bypass in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows high-privileged authenticated users to upload arbitrary non-image files - including PHP webshells - by disguising them with raster image file extensions. The extension's upload handler validated only file extension and basic size parameters, not actual file content, enabling disguised executable files to be stored on the web server. No active exploitation or public proof-of-concept has been identified at time of analysis, but successful exploitation yields full server-side code execution with scope change impact.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Arbitrary PHP file upload leading to remote code execution in the Joomla Event Manager extension (joomlaeventmanager.net) versions before 5.0.1 allows an authenticated administrator to write dangerous file types through the administrator source model and execute code on the underlying server. The flaw is a CWE-434 unrestricted upload weakness that turns legitimate back-end file-handling into a webshell delivery path; no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 9.4 reflects total confidentiality, integrity, and availability impact, though exploitation requires existing high privileges (PR:H).
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote attackers to upload web shell backdoors and achieve full arbitrary code execution on the underlying server. The CVSS 4.0 score of 8.7 reflects network-accessible exploitation requiring only low-privilege credentials, with confirmed total technical impact per SSVC. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the Taiwan CERT (TWCERT) has published advisories indicating confirmed vendor awareness.
SQL injection in Thinking Software Technology's Efence (versions ≤ 1.2.66 DB Ver:56) exposes full database contents to unauthenticated remote attackers via the file upload functionality. The CVSS 4.0 score of 8.8 with PR:N and AV:N confirms no credentials are required, and SSVC rates the attack as automatable. No public exploit code or CISA KEV listing exists at time of analysis, but the attack surface is low-complexity and network-accessible.
Unauthenticated arbitrary file upload in Thinking Software Technology's EFence (versions up to and including 1.2.66, DB Ver:56) lets remote attackers upload executable web shell backdoors and run arbitrary code on the underlying server. The flaw requires no authentication or user interaction over the network, yielding full compromise of confidentiality, integrity, and availability. Reported by TWCERT; no public exploit identified at time of analysis, and EPSS exploitation probability is moderate at 0.68% (50th percentile).
Arbitrary file upload leading to remote code execution affects CAYIN Technology's CMS-WS, CMS-SE, and SMP series digital signage management platforms. Privileged remote attackers can upload web shells through the product's file upload functionality and then execute arbitrary commands on the underlying server. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no active exploitation; however, the technical impact is rated total across confidentiality, integrity, and availability.
Arbitrary file upload in DocSys-master V2.02.85 lets remote attackers upload malicious files through the uploadMarkdownPic interface in DocController.java, bypassing intended image-only restrictions on the Markdown picture-upload endpoint. Because a webshell or other executable payload can be written into a web-accessible path, this can escalate to full server compromise and remote code execution. Publicly available exploit code exists (a GitHub write-up with reproduction steps); it is not listed in CISA KEV and EPSS is low (0.14%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
Unrestricted file upload in ContiNew Admin through v4.1.0 allows authenticated users to bypass server-side validation entirely on multipart upload endpoints, storing files with arbitrary extensions in the backend storage. The flaw stems from missing permission checks and the absence of any file-type allowlist in MultipartUploadController.java, meaning a low-privileged account holder can upload content such as server-side scripts. Uploaded files are then accessible via web server URLs, creating a direct path to webshell deployment or persistent malicious content delivery. No public exploit or CISA KEV listing is confirmed at time of analysis.
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in TRtek Software Repository Management (all versions before commit 2fb4acee) lets remote attackers upload executable web shells to the server, yielding server-side code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication or user interaction, and the full C:H/I:H/A:H impact reflects total server compromise. It was reported by Turkey's national CERT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-privilege user to deploy a webshell and execute arbitrary code as the web-server user. The root cause is a permissive default extension allowlist that fails to block .php uploads to columns with _path suffixes when the uploadPath directory is web-served. No public exploit has been identified at time of analysis, but the attack chain is technically trivial for anyone with Adminer credentials and requires no user interaction.
Arbitrary file upload in the UltimateAI WordPress plugin (versions up to and including 3.1.0) lets any authenticated Subscriber-level user upload files with attacker-controlled types, per Patchstack (CVE-2026-32559, CWE-434). Because the plugin fails to validate uploaded file types, a low-privileged account can place a malicious PHP payload on the server, and with a CVSS 3.1 base score of 9.9 and scope change this typically escalates to full remote code execution and site takeover. No public exploit identified at time of analysis.
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. The description constrains uploads to non-executable files, which limits direct remote code execution on hardened servers, but still enables web root content injection, defacement, and potential escalation on misconfigured systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in xShop 3.0.3, an open-source Laravel e-commerce platform by 4xmen, arises from an unrestricted file-upload flaw in the admin attachment handler that accepts executable content such as .php files. An authenticated administrator can upload a crafted PHP payload and have the web server execute it, yielding full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in version 3.0.4, whose diff adds strict MIME-type validation to the upload request.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Arbitrary file upload leading to remote code execution in vsDesk v14.0101 lets an authenticated administrator abuse the "Import via CSV" component, which relies solely on client-side file validation and performs no server-side extension or content checks. Because the check is enforced only in the browser, an admin can trivially submit a malicious file (e.g. a web shell) and have it execute in the context of the web application. No public exploit has been identified at time of analysis, though the flaw was reported by Kaspersky and a vendor patch exists in versions 14.0402 and later.
Unrestricted file upload in the ATutor Gameme module allows any authenticated user to achieve remote code execution on the web server. The module stores uploaded files in a web-accessible directory before validating their content or type, meaning a malicious server-executable script (e.g., PHP webshell) can be uploaded and immediately retrieved via HTTP to trigger execution as the web server process user. ATutor 2.2.4 is confirmed vulnerable; the product is end-of-life with no patch available or planned.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Remote code execution is achievable on the Frauscher FDS 102 field data server when a high-privileged attacker uploads a PHP webshell and retrieves it directly via /uploads/<filename>.php, bypassing file type validation entirely (CWE-434). All versions appear affected per the wildcard CPE string reported by CERTVDE in advisory VDE-2026-078. Full system compromise - including loss of confidentiality, integrity, and availability - is the confirmed worst-case impact, with particular significance in railway operational technology environments where the FDS 102 manages sensor and axle-counting infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as a permitted MIME type, which is then served under the Wekan origin and executes in any user's browser that opens the attachment. The vulnerability is rooted in a silent fallback: when the Unix `file` binary is absent (typical of minimal Docker/Alpine deployments), MIME detection returns undefined and validation trusts the attacker-supplied content type instead of inspecting actual file bytes. Exploitation is conditional on two deployment-specific factors - the WITH_API=true environment variable and the absence of the `file` binary - but both are common in container-based Wekan deployments. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the Elementor Pro WordPress plugin from unspecified early versions through 4.2.1, allowing a remote attacker with no credentials to upload a dangerously-typed file (e.g. a PHP webshell) and execute code on the hosting server. Reported by Patchstack and carrying a critical 9.0 CVSS score with a scope-changing vector, the flaw can result in full site and potentially host compromise. No public exploit identified at time of analysis, though Patchstack's write-up explicitly frames it as an unauthenticated file-upload-to-RCE path, making it a high-priority patch for any WordPress site running the Pro add-on.
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote attackers write or remove files anywhere in the component's site and administrator directory trees, enabling web shell deployment and full site compromise. The flaw combines a client-controlled storage root (_path_type), absent path-containment checks, a weak file-extension filter, and a missing CSRF token on the upload/remove handlers. Rated CVSS 4.0 10.0 (critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64) allows remote attackers to upload arbitrary files, including web shells, because the image element only validates the client-supplied Content-Type header against the image MIME group rather than the actual file contents or extension. Rated CVSS 4.0 base 10.0 with full confidentiality, integrity, and availability impact plus scope change, this is a critical pre-authentication flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre.
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The low privilege barrier (any Contributor) combined with high confidentiality, integrity and availability impact makes this a severe multi-tenant and membership-site risk.
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding only Contributor-level privileges upload files of any type, including PHP webshells, bypassing WordPress's normal media-type restrictions. Because the flaw carries a scope-changed CVSS 3.1 score of 9.9, a successful upload typically escalates to remote code execution and full site compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low authentication barrier and high impact make it a strong patch priority.
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis.
Remote code execution in WordPress exposes sites to full server compromise when an Author-level (or higher) authenticated user uploads a specially crafted PostScript file that is subsequently processed by Imagick and Ghostscript. The vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), leverages Ghostscript's Turing-complete PostScript interpreter to execute arbitrary OS-level commands under the web server's process identity. No public exploit has been identified at time of analysis, but the low privilege bar - requiring only an Author account - and WordPress's massive global deployment footprint make this a high-priority remediation item for any self-hosted installation running Imagick with Ghostscript.
Remote code execution in RainyGao DocSys 2.02.80 arises from an unrestricted file-upload handler (CWE-434) that fails to validate uploaded file type or extension, letting a remote attacker plant a server-executable payload (e.g. a webshell) and run arbitrary commands. The flaw carries a CVSS 9.8 with a fully remote, low-complexity, no-privilege, no-interaction vector, and a public technical write-up/POC exists in a third-party GitHub repository. It is not listed in CISA KEV, and EPSS is low at 0.26% (18th percentile), indicating no evidence of widespread automated exploitation yet.
Arbitrary file upload in 2100 Technology's Official Document Management System (all versions before 5.0.105) enables authenticated remote attackers to upload and execute web shell backdoors, achieving full arbitrary code execution on the underlying server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms network-accessible exploitation requiring only a low-privileged account, with total impact across confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution is achievable in T-Systems International GmbH ImageMaster version 9.14.2.8.1 through an unrestricted file upload flaw in the 'add attachments' feature of the document creation workflow. A remote attacker can upload a malicious executable file (e.g., a webshell) and subsequently trigger its server-side execution, achieving full system compromise. A proof-of-concept exploit is publicly available per SSVC data and a GitHub repository linked in references; however, no CISA KEV listing has been recorded and EPSS exploitation probability is notably low at 0.59% (45th percentile), indicating limited observed in-the-wild activity at time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Unbounded zlib decompression in Pandora's DAA file extractor enables unauthenticated remote attackers to trigger memory and CPU exhaustion by submitting a crafted zip-bomb DAA archive. Because Pandora is a file analysis platform whose core function is accepting untrusted files, the attack surface is directly aligned with the product's intended use - no special access or configuration is required beyond file submission. The CVSS 4.0 score of 8.7 reflects high availability impact on the extraction worker with limited subsequent service degradation; no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, though exploitation is trivially simple for anyone familiar with zip bomb construction.
Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0.3.683, caused by an unrestricted file upload (CWE-434) that lets an attacker place a file of a dangerous type on the server. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are required, and the high integrity impact (I:H) reflects the ability to modify or replace server-side content with attacker-controlled code. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and network reachability of the WMS administrative web interface make rapid patching the correct posture.
We need answer JSON only. Let's analyze. CVE-2026-81239 Dell Wyse Management Suite versions prior to 2605.0.3.683 unrestricted upload dangerous file type. Unauthenticated remote access, RCE. CVSS 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. CWE-434. CPE dell wyse_management_suite. Tags Dell, File Upload, Wyse Management Suite. Reference Dell advisory. No EPSS/KEV provided. Not in KEV. POC unknown. Patch likely version 2605.0.3.683. Need produce fields. Be careful: "unauthenticated" allowed because CVSS PR:N. Description says unauthenticated. Exploitation status: no public exploit identified at time of analysis (no POC, no KEV). Patch status maybe vendor advisory but exact fix version from description? Yes fixed in 2605.0.3.683? "versions prior to 2605.0.3.683 contain..." implies upgrade to 2605.0.3.683. So "Vendor-released patch: 2605.0.3.683" perhaps. But input didn't explicitly say patch available? It says versions prior to contain vulnerability, Dell advisory security update. We can say Vendor-released patch: 2605.0.3.683. Maybe okay. But precision: if input includes exact fix version. "versions prior to 2605.0.3.683" is exact fix threshold. So yes. Product name: "Dell Wyse Management Suite" maybe 4 words? They said 1-3 words ONLY. "Wyse Management Suite" is 3 words. Or "Dell Wyse Management" no. Use "Wyse Management Suite" (Dell vendor omitted but product). Maybe "Dell Wyse Management Suite" is 4 words. Use "Wyse Management Suite". Summary original. Must not start with A vulnerability etc. Start impact verb and product. "Unauthenticated remote file upload in Dell Wyse Management Suite (versions before 2605.0.3.683) allows attackers to upload dangerous file types and achieve remote code execution." Mention no KEV POC? "No public exploit identified at time of analysis." EPSS not provided. Okay. Technical context: CWE-434 unrestricted upload dangerous type. Dell WMS is endpoint management for Wyse thin clients, often admin portal. File upload endpoint lacks file t
Unauthenticated remote attackers can upload files of dangerous type to Dell Wyse Management Suite deployments running versions prior to 2605.0.3.683, because the console fails to restrict uploaded file types (CWE-434), which allows a crafted payload such as a web shell to be placed and executed on the server. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are required — only network reachability to the WMS web interface. Neither CISA KEV listing nor public exploit code has been identified in the supplied intelligence, so at time of analysis this is a severe but not yet confirmed-exploited issue.
Arbitrary code execution is possible on Contec CAN 2.0B series communication converter units (CAN-2-WF wireless LAN and CAN-2-USB USB variants) via unrestricted file upload. A remote attacker holding high-privilege credentials can upload a specially crafted file to the device's web interface, resulting in code execution directly on the embedded unit. Reported by JPCERT/CC with a vendor advisory; no public exploit or CISA KEV listing identified at time of analysis.
Arbitrary command execution via unrestricted file upload affects CONTEC's CONPROSYS TM Series industrial controllers (CPS-TM341G5MB-ADSC1-931, CPS-TM341MB-ADSC1-931, and CPS-TM341GMB-ADSC1-931). A remote attacker holding valid credentials can upload a specially crafted file through the device's management interface, causing the underlying system to execute attacker-controlled commands. The CVSS 4.0 score of 8.7 reflects full confidentiality, integrity, and availability compromise of the vulnerable system, with authentication as the sole barrier to exploitation. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the 'WP images upload on piclect' WordPress plugin (versions through 1.0) arises because the plugin writes uploaded files to a publicly accessible directory without validating the filename or MIME/content type. Any remote attacker can upload a PHP file and request it directly to run arbitrary code as the web server. Reported by WPScan with a maximal 9.8 CVSS; no public exploit code is identified at time of analysis and EPSS remains low at 0.16%.
Remote code execution in the DS Ad Rotator WordPress plugin (all versions through 0.8) allows unauthenticated attackers to upload arbitrary files, including PHP scripts, because the image upload handler enforces no capability check, no nonce verification, and no file-type validation. Any anonymous visitor can drop a web shell into a web-accessible directory and execute it for full server compromise. WPScan reports the flaw with a public advisory; no public exploit is identified at time of analysis and EPSS risk is low (0.20%), but the exploitation technique is trivial and well understood.
Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.
Authenticated remote code execution is possible in BurgerEditor versions 3.2.0-3.4.0 (and 2.28.0-2.30.0 per EUVD data) via unrestricted file upload, allowing a logged-in attacker to upload arbitrary PHP files and execute server-side code. The vulnerability stems from insufficient validation of uploaded file types (CWE-434), enabling placement of attacker-controlled executables in a web-accessible location. No public exploit code or active exploitation has been identified at time of analysis, though the attack is straightforward once authentication is obtained.
Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch.
Arbitrary file upload with path traversal in LZ-litchi 1.0.0 lets remote unauthenticated attackers write attacker-controlled files to locations outside the intended storage directory by manipulating the 'directory' parameter of POST /app-api/infra/file/upload. Because uploaded content and destination path are both attacker-controlled, an attacker can plant a web-executable payload and achieve code execution on the host. No public exploit is confirmed beyond the referenced GitHub issue writeup, and EPSS remains low (0.18%) despite the maximal CVSS of 9.8.
Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated remote code execution in Voltronic Power SNMP Web Pro 1.1 lets remote attackers gain root on the device by POSTing a crafted tar archive to the upload.cgi firmware-update endpoint. Because the archive is extracted into a privileged directory and its contents executed as root without any credential check, a single request yields full system compromise. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC); this is not yet listed in CISA KEV.
Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in AppNitro MachForm v30 permits unauthenticated remote attackers to achieve code execution by uploading a crafted .phar (PHP Archive) file through the application's file upload functionality. Because the application fails to block .phar extensions alongside conventional dangerous types like .php, an attacker can cause the PHP runtime to execute attacker-supplied code upon accessing the uploaded file. A public proof-of-concept is available on GitHub and a write-up is hosted on PacketStorm Security, raising practical exploitability above the low EPSS score would suggest.
Arbitrary file upload via the `/cgi-bin/ugwupload.cgi` endpoint in MBS-Solutions X-Serie Gateway firmware V6_00_05 permits an authenticated administrator to write files of arbitrary content to hardcoded filesystem paths. The CWE-434 flaw can be used to plant backdoors, overwrite critical device configuration, or corrupt the operating environment, potentially resulting in full device compromise. A public proof-of-concept repository exists on GitHub (SilviaMun/vulnerability-research), though current EPSS exploitation probability is low at 0.24% (15th percentile), consistent with a niche embedded device with limited deployment footprint.
Remote code execution in easyadmin v2.0.2.2 lets attackers with access to the background management interface upload a crafted file of a dangerous type (e.g. a PHP webshell) and execute arbitrary code, gaining server-level privileges. The flaw is a classic unrestricted file upload (CWE-434) in an admin-only feature; the description specifies authenticated access despite the provided CVSS vector marking it as requiring no privileges. EPSS is low (0.24%, 15th percentile) and there is no evidence of active exploitation, though a researcher issue writeup is referenced.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
Unauthenticated arbitrary file upload in GeoNetwork prior to versions 4.4.12 and 4.2.17 allows remote attackers to write malicious XSLT or ZIP formatter files directly to the server's formatter directory without any authorization check. Because GeoNetwork processes uploaded `.xsl` formatter files server-side via a Java XSLT engine when rendering metadata records, attackers can weaponize this upload into a remote code execution chain by embedding Java extension function calls within the XSLT payload. No public exploit has been confirmed at time of analysis, but The Hacker News coverage explicitly frames this as unauthenticated RCE, and the exploitation path (malicious XSLT to Java extension-function execution) is a well-documented Java attack technique.
Remote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authenticated administrator to upload a PHP webshell that, once processed, runs arbitrary code as the web-service account. The upload routine trusts the client-supplied filename and never validates file content or securely restricts extensions (CWE-434), so a benign-looking CSV import becomes a code-execution primitive. Disclosed via INCIBE as part of a multi-vulnerability advisory for Ocsreports; no public exploit identified at time of analysis, and no EPSS or KEV signal is present in the input.
Authenticated administrators in UnoPim before version 2.1.5 can achieve full server-side remote code execution by uploading arbitrary PHP files through the TinyMCE image upload endpoint, which performs no file extension or MIME type validation before writing files to the public storage disk. The server response discloses the uploaded file's URL, enabling direct invocation of the web shell and arbitrary OS command execution under the web server process context. A publicly available proof-of-concept and vendor-released patch (v2.1.5) both exist; no CISA KEV listing was identified at time of analysis.
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely.
Arbitrary code execution in Mozilla Thunderbird before 154 (and before ESR 153.2) on Windows allows a crafted calendar (iCalendar) invitation to attach a file:// URI that points at a local or network-hosted executable, bypassing Thunderbird's normal blocking of executable attachments. When the new invitation display is enabled the attachment can also be shown under a misleading, benign-looking filename. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; EPSS is low at 0.15% (5th percentile).
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in Master Addons for Elementor (all versions through 3.1.9) enables WordPress users with editor-level access to achieve remote code execution by exploiting a misconfigured AJAX authorization check. The upload_template_kit() handler incorrectly enforces only the upload_files capability-held by editors by default-rather than the manage_options capability required by every sibling handler, and performs no file-type filtering on content extracted from uploaded ZIP archives, allowing PHP webshells and other executable files to land on the server. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and clear code-level proof in the plugin SVN repository make this a high-priority remediation for any multi-user WordPress site running Elementor.
Unauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, versions up to and including 4.4.1, allows remote attackers to plant executable files on the server and potentially achieve remote code execution. The flaw stems from missing file-type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints, so no login is required. Reported by Wordfence and carrying a CVSS of 9.8; no public exploit identified at time of analysis.
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. Rated CVSS 10.0 with a scope-change vector; no public exploit identified at time of analysis and it is not listed in CISA KEV, though the class of bug is trivially weaponizable.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
File upload restriction bypass in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows high-privileged authenticated users to upload arbitrary non-image files - including PHP webshells - by disguising them with raster image file extensions. The extension's upload handler validated only file extension and basic size parameters, not actual file content, enabling disguised executable files to be stored on the web server. No active exploitation or public proof-of-concept has been identified at time of analysis, but successful exploitation yields full server-side code execution with scope change impact.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Arbitrary PHP file upload leading to remote code execution in the Joomla Event Manager extension (joomlaeventmanager.net) versions before 5.0.1 allows an authenticated administrator to write dangerous file types through the administrator source model and execute code on the underlying server. The flaw is a CWE-434 unrestricted upload weakness that turns legitimate back-end file-handling into a webshell delivery path; no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 9.4 reflects total confidentiality, integrity, and availability impact, though exploitation requires existing high privileges (PR:H).
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote attackers to upload web shell backdoors and achieve full arbitrary code execution on the underlying server. The CVSS 4.0 score of 8.7 reflects network-accessible exploitation requiring only low-privilege credentials, with confirmed total technical impact per SSVC. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the Taiwan CERT (TWCERT) has published advisories indicating confirmed vendor awareness.
SQL injection in Thinking Software Technology's Efence (versions ≤ 1.2.66 DB Ver:56) exposes full database contents to unauthenticated remote attackers via the file upload functionality. The CVSS 4.0 score of 8.8 with PR:N and AV:N confirms no credentials are required, and SSVC rates the attack as automatable. No public exploit code or CISA KEV listing exists at time of analysis, but the attack surface is low-complexity and network-accessible.
Unauthenticated arbitrary file upload in Thinking Software Technology's EFence (versions up to and including 1.2.66, DB Ver:56) lets remote attackers upload executable web shell backdoors and run arbitrary code on the underlying server. The flaw requires no authentication or user interaction over the network, yielding full compromise of confidentiality, integrity, and availability. Reported by TWCERT; no public exploit identified at time of analysis, and EPSS exploitation probability is moderate at 0.68% (50th percentile).
Arbitrary file upload leading to remote code execution affects CAYIN Technology's CMS-WS, CMS-SE, and SMP series digital signage management platforms. Privileged remote attackers can upload web shells through the product's file upload functionality and then execute arbitrary commands on the underlying server. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no active exploitation; however, the technical impact is rated total across confidentiality, integrity, and availability.
Arbitrary file upload in DocSys-master V2.02.85 lets remote attackers upload malicious files through the uploadMarkdownPic interface in DocController.java, bypassing intended image-only restrictions on the Markdown picture-upload endpoint. Because a webshell or other executable payload can be written into a web-accessible path, this can escalate to full server compromise and remote code execution. Publicly available exploit code exists (a GitHub write-up with reproduction steps); it is not listed in CISA KEV and EPSS is low (0.14%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
Unrestricted file upload in ContiNew Admin through v4.1.0 allows authenticated users to bypass server-side validation entirely on multipart upload endpoints, storing files with arbitrary extensions in the backend storage. The flaw stems from missing permission checks and the absence of any file-type allowlist in MultipartUploadController.java, meaning a low-privileged account holder can upload content such as server-side scripts. Uploaded files are then accessible via web server URLs, creating a direct path to webshell deployment or persistent malicious content delivery. No public exploit or CISA KEV listing is confirmed at time of analysis.
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in TRtek Software Repository Management (all versions before commit 2fb4acee) lets remote attackers upload executable web shells to the server, yielding server-side code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication or user interaction, and the full C:H/I:H/A:H impact reflects total server compromise. It was reported by Turkey's national CERT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-privilege user to deploy a webshell and execute arbitrary code as the web-server user. The root cause is a permissive default extension allowlist that fails to block .php uploads to columns with _path suffixes when the uploadPath directory is web-served. No public exploit has been identified at time of analysis, but the attack chain is technically trivial for anyone with Adminer credentials and requires no user interaction.
Arbitrary file upload in the UltimateAI WordPress plugin (versions up to and including 3.1.0) lets any authenticated Subscriber-level user upload files with attacker-controlled types, per Patchstack (CVE-2026-32559, CWE-434). Because the plugin fails to validate uploaded file types, a low-privileged account can place a malicious PHP payload on the server, and with a CVSS 3.1 base score of 9.9 and scope change this typically escalates to full remote code execution and site takeover. No public exploit identified at time of analysis.
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. The description constrains uploads to non-executable files, which limits direct remote code execution on hardened servers, but still enables web root content injection, defacement, and potential escalation on misconfigured systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in xShop 3.0.3, an open-source Laravel e-commerce platform by 4xmen, arises from an unrestricted file-upload flaw in the admin attachment handler that accepts executable content such as .php files. An authenticated administrator can upload a crafted PHP payload and have the web server execute it, yielding full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in version 3.0.4, whose diff adds strict MIME-type validation to the upload request.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Arbitrary file upload leading to remote code execution in vsDesk v14.0101 lets an authenticated administrator abuse the "Import via CSV" component, which relies solely on client-side file validation and performs no server-side extension or content checks. Because the check is enforced only in the browser, an admin can trivially submit a malicious file (e.g. a web shell) and have it execute in the context of the web application. No public exploit has been identified at time of analysis, though the flaw was reported by Kaspersky and a vendor patch exists in versions 14.0402 and later.
Unrestricted file upload in the ATutor Gameme module allows any authenticated user to achieve remote code execution on the web server. The module stores uploaded files in a web-accessible directory before validating their content or type, meaning a malicious server-executable script (e.g., PHP webshell) can be uploaded and immediately retrieved via HTTP to trigger execution as the web server process user. ATutor 2.2.4 is confirmed vulnerable; the product is end-of-life with no patch available or planned.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Remote code execution is achievable on the Frauscher FDS 102 field data server when a high-privileged attacker uploads a PHP webshell and retrieves it directly via /uploads/<filename>.php, bypassing file type validation entirely (CWE-434). All versions appear affected per the wildcard CPE string reported by CERTVDE in advisory VDE-2026-078. Full system compromise - including loss of confidentiality, integrity, and availability - is the confirmed worst-case impact, with particular significance in railway operational technology environments where the FDS 102 manages sensor and axle-counting infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as a permitted MIME type, which is then served under the Wekan origin and executes in any user's browser that opens the attachment. The vulnerability is rooted in a silent fallback: when the Unix `file` binary is absent (typical of minimal Docker/Alpine deployments), MIME detection returns undefined and validation trusts the attacker-supplied content type instead of inspecting actual file bytes. Exploitation is conditional on two deployment-specific factors - the WITH_API=true environment variable and the absence of the `file` binary - but both are common in container-based Wekan deployments. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the Elementor Pro WordPress plugin from unspecified early versions through 4.2.1, allowing a remote attacker with no credentials to upload a dangerously-typed file (e.g. a PHP webshell) and execute code on the hosting server. Reported by Patchstack and carrying a critical 9.0 CVSS score with a scope-changing vector, the flaw can result in full site and potentially host compromise. No public exploit identified at time of analysis, though Patchstack's write-up explicitly frames it as an unauthenticated file-upload-to-RCE path, making it a high-priority patch for any WordPress site running the Pro add-on.
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote attackers write or remove files anywhere in the component's site and administrator directory trees, enabling web shell deployment and full site compromise. The flaw combines a client-controlled storage root (_path_type), absent path-containment checks, a weak file-extension filter, and a missing CSRF token on the upload/remove handlers. Rated CVSS 4.0 10.0 (critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64) allows remote attackers to upload arbitrary files, including web shells, because the image element only validates the client-supplied Content-Type header against the image MIME group rather than the actual file contents or extension. Rated CVSS 4.0 base 10.0 with full confidentiality, integrity, and availability impact plus scope change, this is a critical pre-authentication flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre.
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The low privilege barrier (any Contributor) combined with high confidentiality, integrity and availability impact makes this a severe multi-tenant and membership-site risk.
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding only Contributor-level privileges upload files of any type, including PHP webshells, bypassing WordPress's normal media-type restrictions. Because the flaw carries a scope-changed CVSS 3.1 score of 9.9, a successful upload typically escalates to remote code execution and full site compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low authentication barrier and high impact make it a strong patch priority.
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis.
Remote code execution in WordPress exposes sites to full server compromise when an Author-level (or higher) authenticated user uploads a specially crafted PostScript file that is subsequently processed by Imagick and Ghostscript. The vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), leverages Ghostscript's Turing-complete PostScript interpreter to execute arbitrary OS-level commands under the web server's process identity. No public exploit has been identified at time of analysis, but the low privilege bar - requiring only an Author account - and WordPress's massive global deployment footprint make this a high-priority remediation item for any self-hosted installation running Imagick with Ghostscript.
Remote code execution in RainyGao DocSys 2.02.80 arises from an unrestricted file-upload handler (CWE-434) that fails to validate uploaded file type or extension, letting a remote attacker plant a server-executable payload (e.g. a webshell) and run arbitrary commands. The flaw carries a CVSS 9.8 with a fully remote, low-complexity, no-privilege, no-interaction vector, and a public technical write-up/POC exists in a third-party GitHub repository. It is not listed in CISA KEV, and EPSS is low at 0.26% (18th percentile), indicating no evidence of widespread automated exploitation yet.
Arbitrary file upload in 2100 Technology's Official Document Management System (all versions before 5.0.105) enables authenticated remote attackers to upload and execute web shell backdoors, achieving full arbitrary code execution on the underlying server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms network-accessible exploitation requiring only a low-privileged account, with total impact across confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution is achievable in T-Systems International GmbH ImageMaster version 9.14.2.8.1 through an unrestricted file upload flaw in the 'add attachments' feature of the document creation workflow. A remote attacker can upload a malicious executable file (e.g., a webshell) and subsequently trigger its server-side execution, achieving full system compromise. A proof-of-concept exploit is publicly available per SSVC data and a GitHub repository linked in references; however, no CISA KEV listing has been recorded and EPSS exploitation probability is notably low at 0.59% (45th percentile), indicating limited observed in-the-wild activity at time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Unbounded zlib decompression in Pandora's DAA file extractor enables unauthenticated remote attackers to trigger memory and CPU exhaustion by submitting a crafted zip-bomb DAA archive. Because Pandora is a file analysis platform whose core function is accepting untrusted files, the attack surface is directly aligned with the product's intended use - no special access or configuration is required beyond file submission. The CVSS 4.0 score of 8.7 reflects high availability impact on the extraction worker with limited subsequent service degradation; no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, though exploitation is trivially simple for anyone familiar with zip bomb construction.
Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.