File Upload
Monthly
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Unbounded zlib decompression in Pandora's DAA file extractor enables unauthenticated remote attackers to trigger memory and CPU exhaustion by submitting a crafted zip-bomb DAA archive. Because Pandora is a file analysis platform whose core function is accepting untrusted files, the attack surface is directly aligned with the product's intended use - no special access or configuration is required beyond file submission. The CVSS 4.0 score of 8.7 reflects high availability impact on the extraction worker with limited subsequent service degradation; no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, though exploitation is trivially simple for anyone familiar with zip bomb construction.
Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file write in OpenWrt's luci-app-openvpn (the LuCI web-interface plugin for managing OpenVPN) lets an authenticated web user smuggle a path-traversal sequence through the instance_name2 upload parameter to write files anywhere on the device filesystem. Because OpenWrt processes run as root, an attacker can drop an SSH key into a system directory and obtain persistent root code execution across reboots. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.4 and root-level impact make this a high-priority patch for exposed OpenWrt routers.
WhatsUp Gold versions before 2026.0.2 allow a privileged attacker to configure a LogToFile action with an arbitrary file extension, enabling placement of server-executable files (e.g., .aspx web shells) directly within the IIS web root directory. Progress Software confirmed the issue and released a patch in version 2026.0.2, documented in the August 2026 security bulletin. No public exploit code has been identified at time of analysis, but the high CIA impact combined with the adjacent-network vector makes this a material insider threat and post-compromise persistence risk.
PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD role to upload arbitrary PHP files through the FilePond file-upload component and trigger their server-side execution. The file-type allowlist in `file-upload/php/config.php` is an empty array by default, making the type check a no-op; the filename sanitizer further preserves the `.php` extension intact, and nginx routes any URL terminating in `.php` to php-fpm. No public exploit code has been confirmed and Malcolm is not listed in the CISA KEV catalog at time of analysis, but the CVSS 8.8 rating (CWE-434) and straightforward exploitation path make this a genuine priority for any deployment running a pre-26.06.1 release with RBAC enabled.
Unauthenticated credential theft in the InstaWP Connect WordPress migration plugin (all versions ≤ 0.1.3.6) exposes database access details and API signatures on Apache servers during active migration windows. The plugin predictably derives its AES-256-CBC decryption passphrase as SHA256(migrate_key), where the migrate_key is directly leaked in the filename of the unprotected options file via Apache directory listing - allowing an attacker who finds the file to mathematically recover the encryption key and decrypt the options payload without any brute force. Recovery of the api_signature may enable downstream remote code execution via InstaWP's service API. No public exploit or CISA KEV listing has been confirmed at time of analysis, though the deterministic key derivation significantly reduces exploitation effort.
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Unrestricted file upload in Cockpit CMS versions up to and including 2.6.0 allows any authenticated user to upload PHP scripts via the asset upload endpoint, achieving remote code execution as the web server process. The root cause is the default wildcard (*) value for the allowed_uploads configuration combined with storage of uploaded files in a web-accessible directory - a textbook CWE-434 condition. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier of entry (any authenticated account) makes this a high-priority remediation target for internet-facing deployments.
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from path traversal in the server-import and admin file-upload features that lets an authenticated user write files to arbitrary filesystem paths accessible to the application. By planting a file in an executable or auto-loaded location, a low-privileged authenticated attacker can escalate to code execution in the context of the Crafty Controller process. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in dulldusk phpfm through 1.8.0 lets an unauthenticated attacker upload a malicious PHP file and run it directly on the server. The application ships insecure-by-default: its upload extension allowlist is empty ($upload_ext_filter = array()) and authentication is off (auth_pass is an empty string), so no credentials or configuration changes are needed to reach the vulnerable upload handler. No public exploit has been identified at time of analysis, but the trivial exploitation path and 9.8 CVSS make this a high-priority server-takeover issue for any exposed instance.
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.
Unrestricted file upload via shell_exec in SaiAdmin up to version 5.0.1 exposes the Plugin Upload Endpoint (/app/saipackage/install/upload) to potential remote code execution by authenticated high-privilege users. The affected function passes uploaded plugin content through shell_exec without adequate file-type validation, a pattern consistent with CWE-434 that typically enables server-side code execution beyond simple file storage. A proof-of-concept exploit has been publicly disclosed on GitHub (CVE-2026-19383 issue), raising the operational risk above what the conservative VulDB-assigned CVSS 4.0 score of 5.1 might suggest; no vendor patch has been identified at time of analysis.
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Unauthenticated arbitrary file write in Dinky v1.2.5 and its byte-identical development branch lets anyone who can reach the HTTP port (8888 by default) overwrite files as the Dinky service account, because the POST /download/uploadFromRsByLocal handler feeds a caller-supplied path straight into new File(path) and transferTo(dest) with no validation. The route is exempt from Sa-Token auth and guarded only by a header check against a dinkyToken whose default value is hardcoded in source and shipped to every install, so the guard is effectively no guard. The researcher (VulnCheck) demonstrated full remote code execution by shadowing Dinky.class on the writable, chmod-777 classpath and by planting attacker JavaScript in the served index.html; there is no public exploit identified at time of analysis and it is not in CISA KEV, but the disclosure describes a working demonstration.
Unrestricted file upload in ICS-Park Smart Park Management System v2.0 lets a remote attacker upload and execute arbitrary code through the product's file upload module, yielding full server compromise (CVSS 9.8). Public exploit code exists and the flaw is automatable with total technical impact per CISA SSVC, though the EPSS probability remains low at 0.26% (17th percentile), indicating limited observed exploitation activity so far. No CISA KEV listing means no confirmed active exploitation at time of analysis.
Arbitrary file upload in WSO2 API Manager and related Carbon-based products (API Control Plane, Universal Gateway, Traffic Manager) allows an authenticated publisher-privileged user to write attacker-controlled files to arbitrary server-accessible paths via the System REST API, which can escalate to remote code execution depending on how uploaded content is served or executed. The vendor rates it CVSS 9.1 (scope-changed) and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
Unauthenticated arbitrary file upload in the Type Hub WordPress plugin (versions ≤ 2.0.6) lets remote attackers upload malicious files without any credentials, typically leading to remote code execution and full site compromise. The CVSS 3.1 base score is a maximum 10.0 with a changed scope (S:C), reflecting that a successful upload can pivot beyond the plugin into the underlying host. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it an urgent patch priority.
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is reachable by unauthenticated remote attackers (CVSS 9.3, AV:N/PR:N). Because the CVSS scope is Changed with high confidentiality impact, a crafted request can coerce the plugin into executing attacker-controlled SQL, exposing WordPress database contents such as user records and secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Patchstack.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Unauthenticated file upload in Rongzhitong Visual Integrated Command and Dispatch Platform (versions through 20260617) allows remote attackers to upload arbitrary files - including web shells - to the server via the /dm/dispatch/userinfo/upload endpoint without any authentication. The 'Authentication Bypass' tag confirms that access controls on this endpoint are entirely absent, not merely weak. A public proof-of-concept exploit exists and is circulating, and the vendor has not responded to disclosure contact, meaning no patch is forthcoming. No public exploit identified as confirmed actively exploited (CISA KEV), but PoC availability and zero remediation response substantially raise real-world risk.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
WP-DownloadManager WordPress plugin (all versions prior to 1.69) grants any WordPress administrator holding the manage_downloads capability the ability to achieve full remote code execution by uploading arbitrary PHP files through the unvalidated download-add.php handler. The upload path is additionally constructed from a raw, unsanitized POST parameter, enabling directory traversal into web-accessible locations under WP_CONTENT_DIR where uploaded PHP files execute on direct request. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the complete absence of server-side file-type controls and path sanitization makes exploitation trivially simple for any attacker who has obtained admin credentials.
Remote code execution in Pluck CMS through 4.7.21 is achievable by any authenticated administrator who exploits a gap in the file upload blacklist: the extension '.php8' is absent from the hardcoded deny-list in data/inc/files.php, allowing a crafted file to be stored and subsequently executed as PHP on servers running PHP 8.x. Reported by TuranSec, this CWE-434 flaw carries a CVSS 7.2 (PR:H), meaning exploitation is constrained to admin-level accounts but delivers full confidentiality, integrity, and availability impact once triggered. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the bypass is trivially reproducible from the CVE description by any administrator with upload access.
Arbitrary file upload in LightSync Pro WordPress plugin (all versions through 2.1.6) enables authenticated attackers with Author-level access to upload executable files - including PHP webshells - via the unvalidated `rest_replace_media()` REST API function, with remote code execution as a realistic outcome. The root cause is CWE-434: missing file type validation on the server side, allowing any file extension to be accepted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 reflects the high post-exploitation impact given the minimal privilege bar (Author role).
Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticated attackers to upload a web shell to the server due to unrestricted file-type validation (CWE-434), resulting in full compromise of the HR application host. Any remote attacker can reach the upload functionality without credentials or user interaction and execute arbitrary commands. No public exploit identified at time of analysis, though the maximal CVSS 9.8 severity and trivial exploitability make this a high-priority fix for affected deployments.
Unrestricted file upload in freo2 (by refirio) versions prior to 2.0.0-alpha-14 enables highest-privilege administrative users to upload executable files and trigger arbitrary OS command execution on the underlying server. Reported by JPCERT and covered under JVN#52865575, this is a post-authentication code execution path requiring no user interaction once admin access is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.
Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.
Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with media upload permissions via a multi-segment filename bypass (e.g., shell.php.any.jpg) that defeats the extension blocklist in rex_mediapool::isAllowedExtension. The flaw is a confirmed regression introduced in PR #6213 (February 2025), which replaced a historically correct str_contains guard with weaker str_ends_with logic, reintroducing a double-extension attack class that the codebase had explicitly defended against since 2018. Exploitation additionally requires the target server to run a multi-extension PHP handler (Apache mod_mime AddHandler or unanchored FilesMatch); no public exploit or CISA KEV listing has been identified at time of analysis, and the vendor-released fix is available in version 5.21.1.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Unauthenticated file upload validation bypass in the CodeIgniter4 PHP framework (versions prior to 4.7.4) lets a remote attacker upload executable PHP content by exploiting that the is_image and mime_in strict validation rules never enforced a safe client-supplied filename extension. Applications are affected only when they validate uploads solely with is_image or mime_in (without an independent extension check such as ext_in), persist files under the attacker-controlled client filename, and store them in a web-accessible, script-enabled directory. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list; the upstream fix (commit b6e9a4f, released as v4.7.4) adds client-extension consistency checks.
Remote code execution in Wolf CMS through version 0.8.3.1 allows authenticated attackers holding the file_manager_mkfile capability to write arbitrary PHP files into the web-accessible FILES_DIR and execute them by requesting the file over HTTP. The flaw stems from missing file-extension validation in the FileManagerController create_file() and save() functions (CWE-434). Publicly available exploit code exists (via VulnCheck advisory), though it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).
Unauthenticated remote firmware injection in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, 3050, 3100, 3150) exposes all devices running firmware 1.0.0 through 1.9.0 to arbitrary firmware replacement on the internal charging module. The JupiCore service, responsible for firmware update delivery, performs no cryptographic integrity or authenticity verification before transmitting payloads to the charging module, making this exploitable by any network-reachable attacker with no credentials or user interaction. The vendor confirms a patch exists in firmware 1.9.1, and the vulnerability can be chained with CVE-2026-44104 for compounded impact; no public exploit identified at time of analysis.
Unrestricted file upload in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150 running firmware 1.0.0-1.9.0) allows a low-privileged remote attacker holding 'operator' credentials to push arbitrary files through the REST API endpoint designated for firmware updates. Successful exploitation results in persistent storage of attacker-controlled content on the device filesystem and, through repeated or oversized uploads, potential resource exhaustion leading to Denial-of-Service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch to firmware 1.9.1 is available per CERT VDE advisory VDE-2026-008.
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the Balbooa Gridbox page-builder extension for Joomla (versions before 2.20.2) lets an authenticated user upload files of arbitrary type via the extension's file-upload methods, bypassing type restrictions (CWE-434). Uploading executable server-side code (e.g. a PHP web shell) yields authenticated remote code execution, and the vendor rates it CVSS 4.0 9.4 with an 'Attacked' exploit-maturity flag and 'Red' urgency. The impact is materially worse because it chains with CVE-2026-65884, which lets the attacker create the account required to reach the upload feature - collapsing the privilege barrier and effectively enabling attacker-driven RCE. No public exploit is identified at time of analysis, though the CVSS threat metric (E:A) signals the vendor considers exploitation activity present.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
File upload restriction bypass in Ko
Arbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full server compromise by uploading a malicious SCORM package containing a PHP webshell. The uploaded file is placed in a publicly accessible directory, enabling the attacker to execute arbitrary commands on the underlying server. No evidence of active exploitation or public exploit code exists at this time, but the CVSS score of 9.9 reflects critical severity.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Arbitrary file upload leading to remote code execution affects the WPForms Pro plugin for WordPress in all versions up to and including 1.10.1.1, exploitable by unauthenticated attackers through the ajax_chunk_upload_finalize function. Because file-type validation runs only after chunk metadata and file contents are written to disk, and the assembled file is not removed when validation fails, an attacker can leave an executable payload (e.g. a PHP file) on the server. Reported by Wordfence and tracked as ENISA EUVD-2026-48766, this carries a CVSS 8.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary command execution in SUNNET Corporate Training Management System through v10.3 allows authenticated administrators to upload a malicious ZIP archive via the e-paper draft upload function. Successful exploitation leads to full server compromise. No public exploit code or active exploitation is known, and EPSS indicates low exploitation probability.
Remote code execution in Bold Reports Standalone Report Designer before 14.1.12 lets authenticated users abuse the file-upload feature to write files outside the intended directory via a crafted filename, ultimately running arbitrary commands with high privileges on the host. The flaw chains a CWE-22 path traversal into server-side command execution, and per the CVSS 4.0 vector requires only low privileges with no user interaction over the network. No public exploit identified at time of analysis, though a VulnCheck advisory documents the issue.
Arbitrary file upload in the Really Simple CSV Importer WordPress plugin (versions <= 1.3) lets an authenticated administrator write files of dangerous types into a web-accessible path, enabling web shell deployment and full site/server compromise. Reported by Patchstack, it carries a CVSS 9.1 (scope-changed) rating, but exploitation requires high privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the rtCamp GoDAM WordPress plugin (versions ≤ 1.12.2) allows remote attackers to plant executable files and likely achieve remote code execution. The flaw lives in the plugin's WPForms video-field integration, which bypasses WordPress's built-in upload sanitization by trusting the client-supplied Content-Type header and moving raw uploads into a web-served directory. No public exploit code has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority patch for any exposed site.
CRLF injection in Netty's HttpPostRequestEncoder allows authenticated network attackers to inject arbitrary MIME headers into multipart HTTP request bodies by embedding CR/LF characters in user-controlled filenames. Affected are all Netty 4.1.x releases before 4.1.136.Final and 4.2.x releases before 4.2.16.Final that use the codec-http multipart encoder. Publicly available exploit code has been verified against 4.2.12.Final; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the PoC lowers the bar considerably for Content-Type spoofing, stored XSS, and multipart boundary confusion attacks.
Authenticated arbitrary file upload in the Page Builder CK extension for Joomla (vendor joomlack.fr) allows a low-privileged authenticated user to upload a malicious file and achieve remote code execution on the host. The flaw (CWE-434) carries a CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus subsequent-system impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unrestricted file upload in ZS-Admin (zsadmin2025/zs-admin-java) exposes the /api/system/file/upload API endpoint to malicious file submission by authenticated low-privilege users. The SysFileController component fails to validate or restrict file types, allowing an attacker to upload arbitrary content to the server. A public proof-of-concept exists via the project's GitHub issue tracker; the vendor has not yet responded or issued a patch as of the time of disclosure.
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Unbounded zlib decompression in Pandora's DAA file extractor enables unauthenticated remote attackers to trigger memory and CPU exhaustion by submitting a crafted zip-bomb DAA archive. Because Pandora is a file analysis platform whose core function is accepting untrusted files, the attack surface is directly aligned with the product's intended use - no special access or configuration is required beyond file submission. The CVSS 4.0 score of 8.7 reflects high availability impact on the extraction worker with limited subsequent service degradation; no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, though exploitation is trivially simple for anyone familiar with zip bomb construction.
Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file write in OpenWrt's luci-app-openvpn (the LuCI web-interface plugin for managing OpenVPN) lets an authenticated web user smuggle a path-traversal sequence through the instance_name2 upload parameter to write files anywhere on the device filesystem. Because OpenWrt processes run as root, an attacker can drop an SSH key into a system directory and obtain persistent root code execution across reboots. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.4 and root-level impact make this a high-priority patch for exposed OpenWrt routers.
WhatsUp Gold versions before 2026.0.2 allow a privileged attacker to configure a LogToFile action with an arbitrary file extension, enabling placement of server-executable files (e.g., .aspx web shells) directly within the IIS web root directory. Progress Software confirmed the issue and released a patch in version 2026.0.2, documented in the August 2026 security bulletin. No public exploit code has been identified at time of analysis, but the high CIA impact combined with the adjacent-network vector makes this a material insider threat and post-compromise persistence risk.
PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD role to upload arbitrary PHP files through the FilePond file-upload component and trigger their server-side execution. The file-type allowlist in `file-upload/php/config.php` is an empty array by default, making the type check a no-op; the filename sanitizer further preserves the `.php` extension intact, and nginx routes any URL terminating in `.php` to php-fpm. No public exploit code has been confirmed and Malcolm is not listed in the CISA KEV catalog at time of analysis, but the CVSS 8.8 rating (CWE-434) and straightforward exploitation path make this a genuine priority for any deployment running a pre-26.06.1 release with RBAC enabled.
Unauthenticated credential theft in the InstaWP Connect WordPress migration plugin (all versions ≤ 0.1.3.6) exposes database access details and API signatures on Apache servers during active migration windows. The plugin predictably derives its AES-256-CBC decryption passphrase as SHA256(migrate_key), where the migrate_key is directly leaked in the filename of the unprotected options file via Apache directory listing - allowing an attacker who finds the file to mathematically recover the encryption key and decrypt the options payload without any brute force. Recovery of the api_signature may enable downstream remote code execution via InstaWP's service API. No public exploit or CISA KEV listing has been confirmed at time of analysis, though the deterministic key derivation significantly reduces exploitation effort.
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.
Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.
Unrestricted file upload in Cockpit CMS versions up to and including 2.6.0 allows any authenticated user to upload PHP scripts via the asset upload endpoint, achieving remote code execution as the web server process. The root cause is the default wildcard (*) value for the allowed_uploads configuration combined with storage of uploaded files in a web-accessible directory - a textbook CWE-434 condition. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier of entry (any authenticated account) makes this a high-priority remediation target for internet-facing deployments.
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from path traversal in the server-import and admin file-upload features that lets an authenticated user write files to arbitrary filesystem paths accessible to the application. By planting a file in an executable or auto-loaded location, a low-privileged authenticated attacker can escalate to code execution in the context of the Crafty Controller process. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in dulldusk phpfm through 1.8.0 lets an unauthenticated attacker upload a malicious PHP file and run it directly on the server. The application ships insecure-by-default: its upload extension allowlist is empty ($upload_ext_filter = array()) and authentication is off (auth_pass is an empty string), so no credentials or configuration changes are needed to reach the vulnerable upload handler. No public exploit has been identified at time of analysis, but the trivial exploitation path and 9.8 CVSS make this a high-priority server-takeover issue for any exposed instance.
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.
Unrestricted file upload via shell_exec in SaiAdmin up to version 5.0.1 exposes the Plugin Upload Endpoint (/app/saipackage/install/upload) to potential remote code execution by authenticated high-privilege users. The affected function passes uploaded plugin content through shell_exec without adequate file-type validation, a pattern consistent with CWE-434 that typically enables server-side code execution beyond simple file storage. A proof-of-concept exploit has been publicly disclosed on GitHub (CVE-2026-19383 issue), raising the operational risk above what the conservative VulDB-assigned CVSS 4.0 score of 5.1 might suggest; no vendor patch has been identified at time of analysis.
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Unauthenticated arbitrary file write in Dinky v1.2.5 and its byte-identical development branch lets anyone who can reach the HTTP port (8888 by default) overwrite files as the Dinky service account, because the POST /download/uploadFromRsByLocal handler feeds a caller-supplied path straight into new File(path) and transferTo(dest) with no validation. The route is exempt from Sa-Token auth and guarded only by a header check against a dinkyToken whose default value is hardcoded in source and shipped to every install, so the guard is effectively no guard. The researcher (VulnCheck) demonstrated full remote code execution by shadowing Dinky.class on the writable, chmod-777 classpath and by planting attacker JavaScript in the served index.html; there is no public exploit identified at time of analysis and it is not in CISA KEV, but the disclosure describes a working demonstration.
Unrestricted file upload in ICS-Park Smart Park Management System v2.0 lets a remote attacker upload and execute arbitrary code through the product's file upload module, yielding full server compromise (CVSS 9.8). Public exploit code exists and the flaw is automatable with total technical impact per CISA SSVC, though the EPSS probability remains low at 0.26% (17th percentile), indicating limited observed exploitation activity so far. No CISA KEV listing means no confirmed active exploitation at time of analysis.
Arbitrary file upload in WSO2 API Manager and related Carbon-based products (API Control Plane, Universal Gateway, Traffic Manager) allows an authenticated publisher-privileged user to write attacker-controlled files to arbitrary server-accessible paths via the System REST API, which can escalate to remote code execution depending on how uploaded content is served or executed. The vendor rates it CVSS 9.1 (scope-changed) and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
Unauthenticated arbitrary file upload in the Type Hub WordPress plugin (versions ≤ 2.0.6) lets remote attackers upload malicious files without any credentials, typically leading to remote code execution and full site compromise. The CVSS 3.1 base score is a maximum 10.0 with a changed scope (S:C), reflecting that a successful upload can pivot beyond the plugin into the underlying host. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it an urgent patch priority.
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is reachable by unauthenticated remote attackers (CVSS 9.3, AV:N/PR:N). Because the CVSS scope is Changed with high confidentiality impact, a crafted request can coerce the plugin into executing attacker-controlled SQL, exposing WordPress database contents such as user records and secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Patchstack.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Unauthenticated file upload in Rongzhitong Visual Integrated Command and Dispatch Platform (versions through 20260617) allows remote attackers to upload arbitrary files - including web shells - to the server via the /dm/dispatch/userinfo/upload endpoint without any authentication. The 'Authentication Bypass' tag confirms that access controls on this endpoint are entirely absent, not merely weak. A public proof-of-concept exploit exists and is circulating, and the vendor has not responded to disclosure contact, meaning no patch is forthcoming. No public exploit identified as confirmed actively exploited (CISA KEV), but PoC availability and zero remediation response substantially raise real-world risk.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
WP-DownloadManager WordPress plugin (all versions prior to 1.69) grants any WordPress administrator holding the manage_downloads capability the ability to achieve full remote code execution by uploading arbitrary PHP files through the unvalidated download-add.php handler. The upload path is additionally constructed from a raw, unsanitized POST parameter, enabling directory traversal into web-accessible locations under WP_CONTENT_DIR where uploaded PHP files execute on direct request. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the complete absence of server-side file-type controls and path sanitization makes exploitation trivially simple for any attacker who has obtained admin credentials.
Remote code execution in Pluck CMS through 4.7.21 is achievable by any authenticated administrator who exploits a gap in the file upload blacklist: the extension '.php8' is absent from the hardcoded deny-list in data/inc/files.php, allowing a crafted file to be stored and subsequently executed as PHP on servers running PHP 8.x. Reported by TuranSec, this CWE-434 flaw carries a CVSS 7.2 (PR:H), meaning exploitation is constrained to admin-level accounts but delivers full confidentiality, integrity, and availability impact once triggered. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the bypass is trivially reproducible from the CVE description by any administrator with upload access.
Arbitrary file upload in LightSync Pro WordPress plugin (all versions through 2.1.6) enables authenticated attackers with Author-level access to upload executable files - including PHP webshells - via the unvalidated `rest_replace_media()` REST API function, with remote code execution as a realistic outcome. The root cause is CWE-434: missing file type validation on the server side, allowing any file extension to be accepted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 reflects the high post-exploitation impact given the minimal privilege bar (Author role).
Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticated attackers to upload a web shell to the server due to unrestricted file-type validation (CWE-434), resulting in full compromise of the HR application host. Any remote attacker can reach the upload functionality without credentials or user interaction and execute arbitrary commands. No public exploit identified at time of analysis, though the maximal CVSS 9.8 severity and trivial exploitability make this a high-priority fix for affected deployments.
Unrestricted file upload in freo2 (by refirio) versions prior to 2.0.0-alpha-14 enables highest-privilege administrative users to upload executable files and trigger arbitrary OS command execution on the underlying server. Reported by JPCERT and covered under JVN#52865575, this is a post-authentication code execution path requiring no user interaction once admin access is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.
Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.
Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with media upload permissions via a multi-segment filename bypass (e.g., shell.php.any.jpg) that defeats the extension blocklist in rex_mediapool::isAllowedExtension. The flaw is a confirmed regression introduced in PR #6213 (February 2025), which replaced a historically correct str_contains guard with weaker str_ends_with logic, reintroducing a double-extension attack class that the codebase had explicitly defended against since 2018. Exploitation additionally requires the target server to run a multi-extension PHP handler (Apache mod_mime AddHandler or unanchored FilesMatch); no public exploit or CISA KEV listing has been identified at time of analysis, and the vendor-released fix is available in version 5.21.1.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Unauthenticated file upload validation bypass in the CodeIgniter4 PHP framework (versions prior to 4.7.4) lets a remote attacker upload executable PHP content by exploiting that the is_image and mime_in strict validation rules never enforced a safe client-supplied filename extension. Applications are affected only when they validate uploads solely with is_image or mime_in (without an independent extension check such as ext_in), persist files under the attacker-controlled client filename, and store them in a web-accessible, script-enabled directory. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list; the upstream fix (commit b6e9a4f, released as v4.7.4) adds client-extension consistency checks.
Remote code execution in Wolf CMS through version 0.8.3.1 allows authenticated attackers holding the file_manager_mkfile capability to write arbitrary PHP files into the web-accessible FILES_DIR and execute them by requesting the file over HTTP. The flaw stems from missing file-extension validation in the FileManagerController create_file() and save() functions (CWE-434). Publicly available exploit code exists (via VulnCheck advisory), though it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).
Unauthenticated remote firmware injection in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, 3050, 3100, 3150) exposes all devices running firmware 1.0.0 through 1.9.0 to arbitrary firmware replacement on the internal charging module. The JupiCore service, responsible for firmware update delivery, performs no cryptographic integrity or authenticity verification before transmitting payloads to the charging module, making this exploitable by any network-reachable attacker with no credentials or user interaction. The vendor confirms a patch exists in firmware 1.9.1, and the vulnerability can be chained with CVE-2026-44104 for compounded impact; no public exploit identified at time of analysis.
Unrestricted file upload in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150 running firmware 1.0.0-1.9.0) allows a low-privileged remote attacker holding 'operator' credentials to push arbitrary files through the REST API endpoint designated for firmware updates. Successful exploitation results in persistent storage of attacker-controlled content on the device filesystem and, through repeated or oversized uploads, potential resource exhaustion leading to Denial-of-Service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch to firmware 1.9.1 is available per CERT VDE advisory VDE-2026-008.
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the Balbooa Gridbox page-builder extension for Joomla (versions before 2.20.2) lets an authenticated user upload files of arbitrary type via the extension's file-upload methods, bypassing type restrictions (CWE-434). Uploading executable server-side code (e.g. a PHP web shell) yields authenticated remote code execution, and the vendor rates it CVSS 4.0 9.4 with an 'Attacked' exploit-maturity flag and 'Red' urgency. The impact is materially worse because it chains with CVE-2026-65884, which lets the attacker create the account required to reach the upload feature - collapsing the privilege barrier and effectively enabling attacker-driven RCE. No public exploit is identified at time of analysis, though the CVSS threat metric (E:A) signals the vendor considers exploitation activity present.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
File upload restriction bypass in Ko
Arbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full server compromise by uploading a malicious SCORM package containing a PHP webshell. The uploaded file is placed in a publicly accessible directory, enabling the attacker to execute arbitrary commands on the underlying server. No evidence of active exploitation or public exploit code exists at this time, but the CVSS score of 9.9 reflects critical severity.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Arbitrary file upload leading to remote code execution affects the WPForms Pro plugin for WordPress in all versions up to and including 1.10.1.1, exploitable by unauthenticated attackers through the ajax_chunk_upload_finalize function. Because file-type validation runs only after chunk metadata and file contents are written to disk, and the assembled file is not removed when validation fails, an attacker can leave an executable payload (e.g. a PHP file) on the server. Reported by Wordfence and tracked as ENISA EUVD-2026-48766, this carries a CVSS 8.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary command execution in SUNNET Corporate Training Management System through v10.3 allows authenticated administrators to upload a malicious ZIP archive via the e-paper draft upload function. Successful exploitation leads to full server compromise. No public exploit code or active exploitation is known, and EPSS indicates low exploitation probability.
Remote code execution in Bold Reports Standalone Report Designer before 14.1.12 lets authenticated users abuse the file-upload feature to write files outside the intended directory via a crafted filename, ultimately running arbitrary commands with high privileges on the host. The flaw chains a CWE-22 path traversal into server-side command execution, and per the CVSS 4.0 vector requires only low privileges with no user interaction over the network. No public exploit identified at time of analysis, though a VulnCheck advisory documents the issue.
Arbitrary file upload in the Really Simple CSV Importer WordPress plugin (versions <= 1.3) lets an authenticated administrator write files of dangerous types into a web-accessible path, enabling web shell deployment and full site/server compromise. Reported by Patchstack, it carries a CVSS 9.1 (scope-changed) rating, but exploitation requires high privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the rtCamp GoDAM WordPress plugin (versions ≤ 1.12.2) allows remote attackers to plant executable files and likely achieve remote code execution. The flaw lives in the plugin's WPForms video-field integration, which bypasses WordPress's built-in upload sanitization by trusting the client-supplied Content-Type header and moving raw uploads into a web-served directory. No public exploit code has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority patch for any exposed site.
CRLF injection in Netty's HttpPostRequestEncoder allows authenticated network attackers to inject arbitrary MIME headers into multipart HTTP request bodies by embedding CR/LF characters in user-controlled filenames. Affected are all Netty 4.1.x releases before 4.1.136.Final and 4.2.x releases before 4.2.16.Final that use the codec-http multipart encoder. Publicly available exploit code has been verified against 4.2.12.Final; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the PoC lowers the bar considerably for Content-Type spoofing, stored XSS, and multipart boundary confusion attacks.
Authenticated arbitrary file upload in the Page Builder CK extension for Joomla (vendor joomlack.fr) allows a low-privileged authenticated user to upload a malicious file and achieve remote code execution on the host. The flaw (CWE-434) carries a CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus subsequent-system impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unrestricted file upload in ZS-Admin (zsadmin2025/zs-admin-java) exposes the /api/system/file/upload API endpoint to malicious file submission by authenticated low-privilege users. The SysFileController component fails to validate or restrict file types, allowing an attacker to upload arbitrary content to the server. A public proof-of-concept exists via the project's GitHub issue tracker; the vendor has not yet responded or issued a patch as of the time of disclosure.
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.