File Upload
Monthly
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.5%.
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.0%.
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.5%.
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 61.9%.
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.9%.
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.6%.
Remote code execution in Apache ActiveMQ 5.x before 5.14.0 allows unauthenticated attackers to upload and execute arbitrary files on the message broker server by chaining HTTP PUT and MOVE requests against the Fileserver web application. This vulnerability is confirmed actively exploited (CISA KEV) with EPSS score of 94.29%, publicly available exploit code exists, and vendor-released patch is available in ActiveMQ 5.14.0.
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.5%.
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.9%.
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.2%.
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.2%.
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.2%.
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.3%.
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.5%.
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.7%.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 48.0%.
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 63.3%.
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 73.6%.
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.7%.
Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.5%.
Unrestricted file upload in WuzhiCMS 4.0 and 4.1.0 allows an authenticated user to upload arbitrary files through the avatar upload handler (member::setAvatar at /index.php?m=member&f=user&v=setAvatar), which can lead to remote code execution if the uploaded file is a server-executable script placed in a web-accessible directory. The vendor was notified via a public issue report but has not responded, so no official fix exists. Public exploit code is available (GitHub issue 219), though the flaw is not listed in CISA KEV, so active exploitation is unconfirmed.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.
Unrestricted file upload in DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final lets unauthenticated remote users push arbitrary files into the application's configured upload storage by posting directly to DotvvmFileUploadMiddleware without a valid X-DotVVM-UploadToken, enabling repeated uploads that exhaust disk space and cause denial of service. The flaw stems from the middleware storing files without verifying a per-render cryptographic token or applying the previously client-supplied type/size constraints server-side. No CISA KEV listing or public exploit code was identified at time of analysis; the vendor has released fixes and adds an optional AuthorizeFileUpload authorization hook.
Unauthenticated file upload in Anil-matcha Open-Generative-AI (versions up to 1.0.11/2.0.0) allows any remote attacker to upload arbitrary files - including HTML, SVG, and executable types - to the application's S3 backend via the /api/upload-binary proxy endpoint. The endpoint accepted requests without any API key check and imposed no restrictions on file type or content, as confirmed by the patch commit f013270957f. No active exploitation or public proof-of-concept has been identified at time of analysis; EPSS data was not provided.
Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis.
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through the avatar upload endpoint, bypassing server-side validation entirely. The vulnerable function FastDFSUtils.upload at the /hr/userface endpoint accepts multipart file submissions without enforcing file-type or content-type restrictions, enabling upload of web shells or other malicious payloads to the FastDFS distributed storage backend. A proof-of-concept exploit is publicly available and the vendor has not responded to disclosure, leaving no official patch in place.
Authenticated path traversal in the file upload functionality of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 allows an admin-level remote attacker to write files outside the intended upload directory, potentially overwriting system files accessible to the affected service. The vendor explicitly states that arbitrary code execution has not been demonstrated, making this an integrity-limited vulnerability rather than a full RCE. Vendor-released firmware patches are available for both affected product lines. No public exploit has been identified at time of analysis.
yshopmall through version 3.3 exposes an unauthenticated file upload endpoint (/api/upload) that performs no file type validation, allowing attackers to place arbitrary HTML, JSP or other executable content on the server. Because uploaded files are reachable from the application's origin, a crafted HTML file can execute script in a victim's browser session (reflected/stored XSS, CVSS 6.1, CWE-79), and a JSP upload could escalate to server-side code execution if the upload directory is served by a JSP-capable container. Exploitation requires a victim to open the attacker-supplied file URL (UI:R); there is no CISA KEV entry and no confirmed public exploit, and EPSS is low at 0.14% (3rd percentile), indicating limited observed activity rather than mass scanning.
Stored cross-site scripting in zhitan-ems 1.0.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by uploading a malicious SVG file through the /equipmentFile/upload endpoint. SVG files support embedded script content, and the application fails to sanitize or restrict SVG payloads before serving them, causing the browser to execute attacker-controlled code in the application's origin context. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (3rd percentile) indicates minimal observed exploitation activity.
Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. A publicly available proof-of-concept exploit exists; active exploitation has not been confirmed in CISA KEV, but the persistent execution path and low-privilege requirement make this a realistic risk for multi-author deployments.
Cross-site scripting in Silverpeas Core 6.4.6 exposes other authenticated users to session hijacking or credential theft via the document management file upload feature. The scope-changed CVSS vector (S:C) confirms the injected script executes in a different security context than the upload origin, enabling impact beyond the uploading user's own session. No public exploit or active exploitation has been confirmed; EPSS at 0.15% (4th percentile) indicates very low current exploitation probability.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Unrestricted file upload in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000 exposes the /Report/Upload/UploadFormImg.ashx endpoint to unauthenticated remote file submission without file-type validation. An unauthenticated network attacker can upload arbitrary file types - including ASP.NET script files such as .aspx webshells - potentially chaining the upload into remote code execution on the underlying IIS server if the upload directory permits script execution. A public proof-of-concept exploit has been disclosed via a Feishu document, and no CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in FeehiCMS up to version 2.1.1 allows unauthenticated remote attackers to upload arbitrary files through the UEditor widget endpoint (UeditorAction::init in backend/widgets/ueditor/UeditorAction.php). A named public proof-of-concept (FEHI-001-UEditor-Unauthorized-File-Upload) is available on GitHub, enabling straightforward exploitation. The vendor has not responded to the coordinated disclosure issue filed at GitHub, and no patch exists at time of analysis.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated customer to upload arbitrary file types through the photo parameter of the Customer Controller endpoint (/customer/controller.php?action=photos), targeting the doupdateimage function. The absence of server-side file-type validation means a low-privileged customer account can upload PHP webshells or other malicious files, enabling remote code execution on the server. A public exploit writeup is available on GitHub demonstrating the RCE chain, making this immediately actionable by opportunistic attackers.
Unrestricted file upload via ZIP extraction in ILIAS MediaPool allows authenticated low-privilege users to bypass extension controls through the subtitle bulk-upload endpoint (`uploadMultipleSubtitleFileObject` backed by `ZipAdapter`), placing arbitrary file types - including PHP scripts - into server directories. Versions 9.x through 9.21, 10.x through 10.9, and 11.x through 11.2 across all active release branches are affected. No public exploit has been identified at time of analysis, but the CWE-434 primitive in a PHP application is a well-understood RCE precursor if extracted files land in a web-executable path.
Unrestricted file upload in ShopEx ECShop 2.5.1 and earlier allows remote attackers to upload arbitrary file types by manipulating the pack_img argument passed to the check_img_type function in admin/pack.php. Successful exploitation can result in webshell deployment, granting full server-side code execution. A public exploit has been disclosed, and the vendor has not responded to disclosure outreach, leaving no official patch available.
Path traversal in MCPHub's MCPB file upload handler, prior to version 0.12.13, enables a remote attacker to extract files to arbitrary filesystem locations and delete arbitrary directories on the host by embedding traversal sequences in a crafted archive manifest. The vulnerability exists at `src/controllers/mcpbController.ts:107`, where `manifest.name` is unsanitized before concatenation into `fs.mkdirSync` and `fs.renameSync` calls; the same unsanitized value flows into `cleanupOldMcpbServer` at line 110, enabling directory deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full source-level disclosure in the GHSA advisory makes weaponization straightforward.
Unrestricted file upload in diem-project/diem through version 5.1.3 exposes the Widget Editor to remote authenticated attackers who can upload arbitrary file types - including executable PHP scripts - via the media form handler dmWidgetContentBaseMediaForm.php. If uploaded files reside in a web-accessible directory without server-enforced execution restrictions, this vulnerability escalates from a file-write primitive to full remote code execution. A public proof-of-concept is available through a GitHub issue; the project has not responded to the disclosure and no patch has been released.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
Unrestricted file upload in Cozmoslabs Profile Builder Plugin for WordPress (versions through 3.16.1) is exploitable without authentication via the wppb_ajax_simple_avatar function exposed on the /wp-admin/admin-ajax.php endpoint. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms unauthenticated remote access with no prerequisites beyond reaching the endpoint, and a proof-of-concept exploit has been publicly released, substantially lowering the barrier to opportunistic mass exploitation. Vendor-released patch version 3.16.2 is available and should be applied immediately on all affected WordPress installations.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achieve first-party script execution in other users' browser sessions by exploiting an extension-confusion flaw in the product photo upload feature. The application validates file content via magic bytes and rejects known PHP extensions, but then names the stored file using the attacker-supplied client extension - allowing a file prefixed with an image header and carrying an .html extension to pass validation, land in the public web root, and be served as text/html. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 4.8 reflects the authentication and victim-interaction prerequisites.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
Remote code execution in Cohere North AI v1.1.5 arises from an arbitrary file upload flaw in the /v1/my_drive/batch_upload endpoint, where insufficient validation of uploaded file type/content lets an attacker place a malicious file that the server subsequently executes. The affected component is part of Cohere's North enterprise AI knowledge platform, and successful exploitation yields full compromise of confidentiality, integrity, and availability. No public exploit is identified in the intelligence feeds, though a third-party technical write-up exists on GitHub; EPSS is low (0.15%, 5th percentile), indicating limited observed exploitation activity to date.
Unrestricted file upload in the Reachy Mini daemon (pip/reachy-mini prior to 1.8.2) permits any unauthenticated network-reachable attacker to write arbitrary files to the robot's filesystem at /tmp/reachy_mini_sounds/<filename>. The daemon's /api/media/sounds/upload endpoint applies no authentication, no extension filtering, no content validation, and no size cap, and is bound to 0.0.0.0 with permissive CORS by default, making every network interface the robot touches an attack surface. The GHSA advisory documents this as step 1 of a three-step compromise chain that, when combined with separately reported Bluetooth authentication bypass and directory traversal vulnerabilities, enables full unauthenticated root access on the robot OS; a public proof-of-concept curl command is embedded in the advisory. No CISA KEV listing identified at time of analysis.
Stored cross-site scripting in Ech0 before 4.4.3 allows authenticated administrators to upload SVG or HTML files containing arbitrary JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and credential exfiltration. The file upload handler at internal/service/file/file.go trusts the client-supplied multipart Content-Type header without server-side magic byte detection or extension validation, and SVG uploads are permitted in the default AllowedTypes configuration without any bypass required. Uploaded files are served publicly without authentication via a gin.Static route, meaning any user - authenticated or not - who visits the file URL triggers execution. Vendor-released patch 4.4.3 is available; no public exploit has been identified at time of analysis.
Stored XSS via SVG logo upload in Roskus Prospero Flow CRM before 5.15.13 permits authenticated users with company management permissions to plant malicious scripts in the application origin. Uploading an SVG document containing embedded script elements or JavaScript event handlers as a company logo causes those scripts to execute in any victim's browser session when the company profile is viewed. No public exploit has been identified at time of analysis and this CVE does not appear in CISA KEV, but the attack is low-complexity and requires only standard CRM user permissions.
Unrestricted file upload in itsourcecode Online Pharmacy System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo argument to the user registration endpoint (all_users/register.php), exploiting the PHP move_uploaded_file function without adequate file type or content validation. The CWE-284 root cause (Improper Access Control) combined with a public registration surface means no authentication barrier exists before reaching the vulnerable code path. A publicly available exploit has been confirmed (E:P in the supplied CVSS 4.0 vector; corroborated by VulDB submission and a published GitHub PoC), making this immediately weaponizable; no active CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
Arbitrary file upload in NewSiteServer (NSS) by CyberTutor allows unauthenticated remote attackers to store malicious HTML files on the server, producing stored XSS-equivalent effects against users who subsequently access those files. All known versions are affected per EUVD and CPE wildcard data; the upload endpoint requires no authentication. No public exploit code or active exploitation has been identified at time of analysis, and no patch version has been independently confirmed from available references.
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.
Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.
Remote code execution in Laravel Backpack CRUD's upload handling allows authenticated administrators to place PHP webshells in web-accessible storage by exploiting the lack of file extension validation inside `HasUploadFields` and `FileNameGenerator`. Affected are installations on the 6.x series before 6.8.14 and the 7.x series before 7.0.38 where the `public` disk with `storage:link` is in use and no explicit `mimes:` or `mimetypes:` Laravel validation rule guards upload fields - conditions common in quickstart-following deployments. No public exploit code has been identified and no CISA KEV listing is present at time of analysis; vendor-confirmed patches are available in releases 6.8.14 and 7.0.38.
Unrestricted file upload in SourceCodester Simple Online Food Ordering System 1.0 allows authenticated administrators to upload arbitrary file types through the menu management endpoint, creating a pathway to remote code execution on the server. The vulnerability resides in `/admin/ajax.php?action=save_menu` where the `img` parameter performs no validation on uploaded file types - a classic CWE-434 failure in a PHP application where server-side script execution of uploaded content is the likely consequence. A public proof-of-concept exploit is available (referenced via GitHub), though no active exploitation has been confirmed in CISA KEV. The provided CVSS 4.0 score of 2.0 is materially understated given that unrestricted PHP file upload almost universally enables webshell deployment and full host compromise.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.
Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
WhatsUp Gold versions before 2026.0.2 allow a privileged attacker to configure a LogToFile action with an arbitrary file extension, enabling placement of server-executable files (e.g., .aspx web shells) directly within the IIS web root directory. Progress Software confirmed the issue and released a patch in version 2026.0.2, documented in the August 2026 security bulletin. No public exploit code has been identified at time of analysis, but the high CIA impact combined with the adjacent-network vector makes this a material insider threat and post-compromise persistence risk.
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unrestricted file upload via shell_exec in SaiAdmin up to version 5.0.1 exposes the Plugin Upload Endpoint (/app/saipackage/install/upload) to potential remote code execution by authenticated high-privilege users. The affected function passes uploaded plugin content through shell_exec without adequate file-type validation, a pattern consistent with CWE-434 that typically enables server-side code execution beyond simple file storage. A proof-of-concept exploit has been publicly disclosed on GitHub (CVE-2026-19383 issue), raising the operational risk above what the conservative VulDB-assigned CVSS 4.0 score of 5.1 might suggest; no vendor patch has been identified at time of analysis.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
Unauthenticated file upload in Rongzhitong Visual Integrated Command and Dispatch Platform (versions through 20260617) allows remote attackers to upload arbitrary files - including web shells - to the server via the /dm/dispatch/userinfo/upload endpoint without any authentication. The 'Authentication Bypass' tag confirms that access controls on this endpoint are entirely absent, not merely weak. A public proof-of-concept exploit exists and is circulating, and the vendor has not responded to disclosure contact, meaning no patch is forthcoming. No public exploit identified as confirmed actively exploited (CISA KEV), but PoC availability and zero remediation response substantially raise real-world risk.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote firmware injection in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, 3050, 3100, 3150) exposes all devices running firmware 1.0.0 through 1.9.0 to arbitrary firmware replacement on the internal charging module. The JupiCore service, responsible for firmware update delivery, performs no cryptographic integrity or authenticity verification before transmitting payloads to the charging module, making this exploitable by any network-reachable attacker with no credentials or user interaction. The vendor confirms a patch exists in firmware 1.9.1, and the vulnerability can be chained with CVE-2026-44104 for compounded impact; no public exploit identified at time of analysis.
Unrestricted file upload in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150 running firmware 1.0.0-1.9.0) allows a low-privileged remote attacker holding 'operator' credentials to push arbitrary files through the REST API endpoint designated for firmware updates. Successful exploitation results in persistent storage of attacker-controlled content on the device filesystem and, through repeated or oversized uploads, potential resource exhaustion leading to Denial-of-Service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch to firmware 1.9.1 is available per CERT VDE advisory VDE-2026-008.
File upload restriction bypass in Ko
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.5%.
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.0%.
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.5%.
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 61.9%.
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.9%.
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.6%.
Remote code execution in Apache ActiveMQ 5.x before 5.14.0 allows unauthenticated attackers to upload and execute arbitrary files on the message broker server by chaining HTTP PUT and MOVE requests against the Fileserver web application. This vulnerability is confirmed actively exploited (CISA KEV) with EPSS score of 94.29%, publicly available exploit code exists, and vendor-released patch is available in ActiveMQ 5.14.0.
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.5%.
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.9%.
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.2%.
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.2%.
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.2%.
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.3%.
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.5%.
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.7%.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 48.0%.
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 63.3%.
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 73.6%.
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.7%.
Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.5%.
Unrestricted file upload in WuzhiCMS 4.0 and 4.1.0 allows an authenticated user to upload arbitrary files through the avatar upload handler (member::setAvatar at /index.php?m=member&f=user&v=setAvatar), which can lead to remote code execution if the uploaded file is a server-executable script placed in a web-accessible directory. The vendor was notified via a public issue report but has not responded, so no official fix exists. Public exploit code is available (GitHub issue 219), though the flaw is not listed in CISA KEV, so active exploitation is unconfirmed.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.
Unrestricted file upload in DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final lets unauthenticated remote users push arbitrary files into the application's configured upload storage by posting directly to DotvvmFileUploadMiddleware without a valid X-DotVVM-UploadToken, enabling repeated uploads that exhaust disk space and cause denial of service. The flaw stems from the middleware storing files without verifying a per-render cryptographic token or applying the previously client-supplied type/size constraints server-side. No CISA KEV listing or public exploit code was identified at time of analysis; the vendor has released fixes and adds an optional AuthorizeFileUpload authorization hook.
Unauthenticated file upload in Anil-matcha Open-Generative-AI (versions up to 1.0.11/2.0.0) allows any remote attacker to upload arbitrary files - including HTML, SVG, and executable types - to the application's S3 backend via the /api/upload-binary proxy endpoint. The endpoint accepted requests without any API key check and imposed no restrictions on file type or content, as confirmed by the patch commit f013270957f. No active exploitation or public proof-of-concept has been identified at time of analysis; EPSS data was not provided.
Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis.
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through the avatar upload endpoint, bypassing server-side validation entirely. The vulnerable function FastDFSUtils.upload at the /hr/userface endpoint accepts multipart file submissions without enforcing file-type or content-type restrictions, enabling upload of web shells or other malicious payloads to the FastDFS distributed storage backend. A proof-of-concept exploit is publicly available and the vendor has not responded to disclosure, leaving no official patch in place.
Authenticated path traversal in the file upload functionality of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 allows an admin-level remote attacker to write files outside the intended upload directory, potentially overwriting system files accessible to the affected service. The vendor explicitly states that arbitrary code execution has not been demonstrated, making this an integrity-limited vulnerability rather than a full RCE. Vendor-released firmware patches are available for both affected product lines. No public exploit has been identified at time of analysis.
yshopmall through version 3.3 exposes an unauthenticated file upload endpoint (/api/upload) that performs no file type validation, allowing attackers to place arbitrary HTML, JSP or other executable content on the server. Because uploaded files are reachable from the application's origin, a crafted HTML file can execute script in a victim's browser session (reflected/stored XSS, CVSS 6.1, CWE-79), and a JSP upload could escalate to server-side code execution if the upload directory is served by a JSP-capable container. Exploitation requires a victim to open the attacker-supplied file URL (UI:R); there is no CISA KEV entry and no confirmed public exploit, and EPSS is low at 0.14% (3rd percentile), indicating limited observed activity rather than mass scanning.
Stored cross-site scripting in zhitan-ems 1.0.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by uploading a malicious SVG file through the /equipmentFile/upload endpoint. SVG files support embedded script content, and the application fails to sanitize or restrict SVG payloads before serving them, causing the browser to execute attacker-controlled code in the application's origin context. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (3rd percentile) indicates minimal observed exploitation activity.
Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. A publicly available proof-of-concept exploit exists; active exploitation has not been confirmed in CISA KEV, but the persistent execution path and low-privilege requirement make this a realistic risk for multi-author deployments.
Cross-site scripting in Silverpeas Core 6.4.6 exposes other authenticated users to session hijacking or credential theft via the document management file upload feature. The scope-changed CVSS vector (S:C) confirms the injected script executes in a different security context than the upload origin, enabling impact beyond the uploading user's own session. No public exploit or active exploitation has been confirmed; EPSS at 0.15% (4th percentile) indicates very low current exploitation probability.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Unrestricted file upload in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000 exposes the /Report/Upload/UploadFormImg.ashx endpoint to unauthenticated remote file submission without file-type validation. An unauthenticated network attacker can upload arbitrary file types - including ASP.NET script files such as .aspx webshells - potentially chaining the upload into remote code execution on the underlying IIS server if the upload directory permits script execution. A public proof-of-concept exploit has been disclosed via a Feishu document, and no CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in FeehiCMS up to version 2.1.1 allows unauthenticated remote attackers to upload arbitrary files through the UEditor widget endpoint (UeditorAction::init in backend/widgets/ueditor/UeditorAction.php). A named public proof-of-concept (FEHI-001-UEditor-Unauthorized-File-Upload) is available on GitHub, enabling straightforward exploitation. The vendor has not responded to the coordinated disclosure issue filed at GitHub, and no patch exists at time of analysis.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated customer to upload arbitrary file types through the photo parameter of the Customer Controller endpoint (/customer/controller.php?action=photos), targeting the doupdateimage function. The absence of server-side file-type validation means a low-privileged customer account can upload PHP webshells or other malicious files, enabling remote code execution on the server. A public exploit writeup is available on GitHub demonstrating the RCE chain, making this immediately actionable by opportunistic attackers.
Unrestricted file upload via ZIP extraction in ILIAS MediaPool allows authenticated low-privilege users to bypass extension controls through the subtitle bulk-upload endpoint (`uploadMultipleSubtitleFileObject` backed by `ZipAdapter`), placing arbitrary file types - including PHP scripts - into server directories. Versions 9.x through 9.21, 10.x through 10.9, and 11.x through 11.2 across all active release branches are affected. No public exploit has been identified at time of analysis, but the CWE-434 primitive in a PHP application is a well-understood RCE precursor if extracted files land in a web-executable path.
Unrestricted file upload in ShopEx ECShop 2.5.1 and earlier allows remote attackers to upload arbitrary file types by manipulating the pack_img argument passed to the check_img_type function in admin/pack.php. Successful exploitation can result in webshell deployment, granting full server-side code execution. A public exploit has been disclosed, and the vendor has not responded to disclosure outreach, leaving no official patch available.
Path traversal in MCPHub's MCPB file upload handler, prior to version 0.12.13, enables a remote attacker to extract files to arbitrary filesystem locations and delete arbitrary directories on the host by embedding traversal sequences in a crafted archive manifest. The vulnerability exists at `src/controllers/mcpbController.ts:107`, where `manifest.name` is unsanitized before concatenation into `fs.mkdirSync` and `fs.renameSync` calls; the same unsanitized value flows into `cleanupOldMcpbServer` at line 110, enabling directory deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full source-level disclosure in the GHSA advisory makes weaponization straightforward.
Unrestricted file upload in diem-project/diem through version 5.1.3 exposes the Widget Editor to remote authenticated attackers who can upload arbitrary file types - including executable PHP scripts - via the media form handler dmWidgetContentBaseMediaForm.php. If uploaded files reside in a web-accessible directory without server-enforced execution restrictions, this vulnerability escalates from a file-write primitive to full remote code execution. A public proof-of-concept is available through a GitHub issue; the project has not responded to the disclosure and no patch has been released.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
Unrestricted file upload in Cozmoslabs Profile Builder Plugin for WordPress (versions through 3.16.1) is exploitable without authentication via the wppb_ajax_simple_avatar function exposed on the /wp-admin/admin-ajax.php endpoint. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms unauthenticated remote access with no prerequisites beyond reaching the endpoint, and a proof-of-concept exploit has been publicly released, substantially lowering the barrier to opportunistic mass exploitation. Vendor-released patch version 3.16.2 is available and should be applied immediately on all affected WordPress installations.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achieve first-party script execution in other users' browser sessions by exploiting an extension-confusion flaw in the product photo upload feature. The application validates file content via magic bytes and rejects known PHP extensions, but then names the stored file using the attacker-supplied client extension - allowing a file prefixed with an image header and carrying an .html extension to pass validation, land in the public web root, and be served as text/html. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 4.8 reflects the authentication and victim-interaction prerequisites.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
Remote code execution in Cohere North AI v1.1.5 arises from an arbitrary file upload flaw in the /v1/my_drive/batch_upload endpoint, where insufficient validation of uploaded file type/content lets an attacker place a malicious file that the server subsequently executes. The affected component is part of Cohere's North enterprise AI knowledge platform, and successful exploitation yields full compromise of confidentiality, integrity, and availability. No public exploit is identified in the intelligence feeds, though a third-party technical write-up exists on GitHub; EPSS is low (0.15%, 5th percentile), indicating limited observed exploitation activity to date.
Unrestricted file upload in the Reachy Mini daemon (pip/reachy-mini prior to 1.8.2) permits any unauthenticated network-reachable attacker to write arbitrary files to the robot's filesystem at /tmp/reachy_mini_sounds/<filename>. The daemon's /api/media/sounds/upload endpoint applies no authentication, no extension filtering, no content validation, and no size cap, and is bound to 0.0.0.0 with permissive CORS by default, making every network interface the robot touches an attack surface. The GHSA advisory documents this as step 1 of a three-step compromise chain that, when combined with separately reported Bluetooth authentication bypass and directory traversal vulnerabilities, enables full unauthenticated root access on the robot OS; a public proof-of-concept curl command is embedded in the advisory. No CISA KEV listing identified at time of analysis.
Stored cross-site scripting in Ech0 before 4.4.3 allows authenticated administrators to upload SVG or HTML files containing arbitrary JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and credential exfiltration. The file upload handler at internal/service/file/file.go trusts the client-supplied multipart Content-Type header without server-side magic byte detection or extension validation, and SVG uploads are permitted in the default AllowedTypes configuration without any bypass required. Uploaded files are served publicly without authentication via a gin.Static route, meaning any user - authenticated or not - who visits the file URL triggers execution. Vendor-released patch 4.4.3 is available; no public exploit has been identified at time of analysis.
Stored XSS via SVG logo upload in Roskus Prospero Flow CRM before 5.15.13 permits authenticated users with company management permissions to plant malicious scripts in the application origin. Uploading an SVG document containing embedded script elements or JavaScript event handlers as a company logo causes those scripts to execute in any victim's browser session when the company profile is viewed. No public exploit has been identified at time of analysis and this CVE does not appear in CISA KEV, but the attack is low-complexity and requires only standard CRM user permissions.
Unrestricted file upload in itsourcecode Online Pharmacy System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo argument to the user registration endpoint (all_users/register.php), exploiting the PHP move_uploaded_file function without adequate file type or content validation. The CWE-284 root cause (Improper Access Control) combined with a public registration surface means no authentication barrier exists before reaching the vulnerable code path. A publicly available exploit has been confirmed (E:P in the supplied CVSS 4.0 vector; corroborated by VulDB submission and a published GitHub PoC), making this immediately weaponizable; no active CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
Arbitrary file upload in NewSiteServer (NSS) by CyberTutor allows unauthenticated remote attackers to store malicious HTML files on the server, producing stored XSS-equivalent effects against users who subsequently access those files. All known versions are affected per EUVD and CPE wildcard data; the upload endpoint requires no authentication. No public exploit code or active exploitation has been identified at time of analysis, and no patch version has been independently confirmed from available references.
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.
Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.
Remote code execution in Laravel Backpack CRUD's upload handling allows authenticated administrators to place PHP webshells in web-accessible storage by exploiting the lack of file extension validation inside `HasUploadFields` and `FileNameGenerator`. Affected are installations on the 6.x series before 6.8.14 and the 7.x series before 7.0.38 where the `public` disk with `storage:link` is in use and no explicit `mimes:` or `mimetypes:` Laravel validation rule guards upload fields - conditions common in quickstart-following deployments. No public exploit code has been identified and no CISA KEV listing is present at time of analysis; vendor-confirmed patches are available in releases 6.8.14 and 7.0.38.
Unrestricted file upload in SourceCodester Simple Online Food Ordering System 1.0 allows authenticated administrators to upload arbitrary file types through the menu management endpoint, creating a pathway to remote code execution on the server. The vulnerability resides in `/admin/ajax.php?action=save_menu` where the `img` parameter performs no validation on uploaded file types - a classic CWE-434 failure in a PHP application where server-side script execution of uploaded content is the likely consequence. A public proof-of-concept exploit is available (referenced via GitHub), though no active exploitation has been confirmed in CISA KEV. The provided CVSS 4.0 score of 2.0 is materially understated given that unrestricted PHP file upload almost universally enables webshell deployment and full host compromise.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.
Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
WhatsUp Gold versions before 2026.0.2 allow a privileged attacker to configure a LogToFile action with an arbitrary file extension, enabling placement of server-executable files (e.g., .aspx web shells) directly within the IIS web root directory. Progress Software confirmed the issue and released a patch in version 2026.0.2, documented in the August 2026 security bulletin. No public exploit code has been identified at time of analysis, but the high CIA impact combined with the adjacent-network vector makes this a material insider threat and post-compromise persistence risk.
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unrestricted file upload via shell_exec in SaiAdmin up to version 5.0.1 exposes the Plugin Upload Endpoint (/app/saipackage/install/upload) to potential remote code execution by authenticated high-privilege users. The affected function passes uploaded plugin content through shell_exec without adequate file-type validation, a pattern consistent with CWE-434 that typically enables server-side code execution beyond simple file storage. A proof-of-concept exploit has been publicly disclosed on GitHub (CVE-2026-19383 issue), raising the operational risk above what the conservative VulDB-assigned CVSS 4.0 score of 5.1 might suggest; no vendor patch has been identified at time of analysis.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
Unauthenticated file upload in Rongzhitong Visual Integrated Command and Dispatch Platform (versions through 20260617) allows remote attackers to upload arbitrary files - including web shells - to the server via the /dm/dispatch/userinfo/upload endpoint without any authentication. The 'Authentication Bypass' tag confirms that access controls on this endpoint are entirely absent, not merely weak. A public proof-of-concept exploit exists and is circulating, and the vendor has not responded to disclosure contact, meaning no patch is forthcoming. No public exploit identified as confirmed actively exploited (CISA KEV), but PoC availability and zero remediation response substantially raise real-world risk.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote firmware injection in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, 3050, 3100, 3150) exposes all devices running firmware 1.0.0 through 1.9.0 to arbitrary firmware replacement on the internal charging module. The JupiCore service, responsible for firmware update delivery, performs no cryptographic integrity or authenticity verification before transmitting payloads to the charging module, making this exploitable by any network-reachable attacker with no credentials or user interaction. The vendor confirms a patch exists in firmware 1.9.1, and the vulnerability can be chained with CVE-2026-44104 for compounded impact; no public exploit identified at time of analysis.
Unrestricted file upload in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150 running firmware 1.0.0-1.9.0) allows a low-privileged remote attacker holding 'operator' credentials to push arbitrary files through the REST API endpoint designated for firmware updates. Successful exploitation results in persistent storage of attacker-controlled content on the device filesystem and, through repeated or oversized uploads, potential resource exhaustion leading to Denial-of-Service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch to firmware 1.9.1 is available per CERT VDE advisory VDE-2026-008.
File upload restriction bypass in Ko