# Unrestricted file upload.

Uploads of dangerous file types, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter](https://agentprime.io/advisories/CVE-2026-108587.md)
  `CVE-2026-108587` · CVE record: 10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Unrestricted file upload
- [FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist](https://agentprime.io/advisories/CVE-2026-57491.md)
  `CVE-2026-57491` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter](https://agentprime.io/advisories/CVE-2026-86461.md)
  `CVE-2026-86461` · CVE record: foliovision FV Flowplayer Video Player · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method](https://agentprime.io/advisories/CVE-2026-87855.md)
  `CVE-2026-87855` · CVE record: ntbyk JTL-Connector for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php](https://agentprime.io/advisories/CVE-2026-104800.md)
  `CVE-2026-104800` · CVE record: streetforce1 AGE-GATE · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter](https://agentprime.io/advisories/CVE-2026-110002.md)
  `CVE-2026-110002` · CVE record: snazzyplugins Snazzy Social Media Feed · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url](https://agentprime.io/advisories/CVE-2026-93388.md)
  `CVE-2026-93388` · CVE record: printcart Printcart Store – Web to Print Product Designer for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)](https://agentprime.io/advisories/CVE-2026-105899.md)
  `CVE-2026-105899` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Unrestricted file upload
- [OpenCATS: Authenticated RCE in the Import module](https://agentprime.io/advisories/CVE-2026-54454.md)
  `CVE-2026-54454` · CVE record: opencats OpenCATS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Unrestricted file upload
- [slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-110025.md)
  `CVE-2026-110025` · CVE record: slackero phpwcms · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-108975.md)
  `CVE-2026-108975` · CVE record: SourceCodester Library Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [SourceCodester E-Learning System Users.php save_users unrestricted upload](https://agentprime.io/advisories/CVE-2026-108974.md)
  `CVE-2026-108974` · CVE record: SourceCodester E-Learning System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-108973.md)
  `CVE-2026-108973` · CVE record: SourceCodester Contact Tracing System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile](https://agentprime.io/advisories/CVE-2026-89271.md)
  `CVE-2026-89271` · CVE record: Unknown WP-BusinessDirectory · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Unrestricted file upload
- [KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload](https://agentprime.io/advisories/CVE-2026-108922.md)
  `CVE-2026-108922` · CVE record: KusalkaSilva Learning-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space](https://agentprime.io/advisories/CVE-2026-109397.md)
  `CVE-2026-109397` · CVE record: Thelia Thelia · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Unrestricted file upload
- [CVE-2026-103535](https://agentprime.io/advisories/CVE-2026-103535.md)
  `CVE-2026-103535` · CVE record: Thelia Thelia · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection, Unrestricted file upload
- [CVE-2026-103529](https://agentprime.io/advisories/CVE-2026-103529.md)
  `CVE-2026-103529` · CVE record: Thelia Thelia · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Unrestricted file upload
- [CVE-2026-103522](https://agentprime.io/advisories/CVE-2026-103522.md)
  `CVE-2026-103522` · CVE record: Thelia Thelia · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Unrestricted file upload
- [CVE-2026-103521](https://agentprime.io/advisories/CVE-2026-103521.md)
  `CVE-2026-103521` · CVE record: Thelia Thelia · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Unrestricted file upload
- [prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-108801.md)
  `CVE-2026-108801` · CVE record: prasathmani TinyFileManager · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process](https://agentprime.io/advisories/CVE-2026-93550.md)
  `CVE-2026-93550` · CVE record: Unknown Veeqo for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Unrestricted file upload
- [Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE](https://agentprime.io/advisories/CVE-2026-104028.md)
  `CVE-2026-104028` · CVE record: Unknown Anton Extensions · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-62129.md)
  `CVE-2026-62129` · CVE record: WPFunnels Creator LMS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-62025.md)
  `CVE-2026-62025` · CVE record: Tailored Media Tailored Tools · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-62024.md)
  `CVE-2026-62024` · CVE record: CodeBard CodeBard Help Desk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import](https://agentprime.io/advisories/CVE-2026-104752.md)
  `CVE-2026-104752` · CVE record: Unknown Rank Math SEO · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos\[\].fv_wp_flowplayer_field_src Parameter](https://agentprime.io/advisories/CVE-2026-83526.md)
  `CVE-2026-83526` · CVE record: foliovision FV Player 8 · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter](https://agentprime.io/advisories/CVE-2026-103889.md)
  `CVE-2026-103889` · CVE record: expivi 3D Product configurator for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload](https://agentprime.io/advisories/CVE-2026-94589.md)
  `CVE-2026-94589` · CVE record: htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import](https://agentprime.io/advisories/CVE-2026-108113.md)
  `CVE-2026-108113` · CVE record: ILIAS-eLearning e.V. ILIAS · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Unrestricted file upload
- [HortusFox through 6.3 Unrestricted File Upload via Plant Attachments](https://agentprime.io/advisories/CVE-2026-108101.md)
  `CVE-2026-108101` · CVE record: danielbrendel hortusfox-web · CVSS 7.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-94503.md)
  `CVE-2026-94503` · CVE record: PX-lab Zombify · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Unrestricted file upload
- [AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import](https://agentprime.io/advisories/CVE-2025-15700.md)
  `CVE-2025-15700` · CVE record: Unknown AWP Classifieds · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Unrestricted file upload
- [Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip](https://agentprime.io/advisories/CVE-2026-91844.md)
  `CVE-2026-91844` · CVE record: İzometri IT Services Domestic and Foreign Trade Co. Ltd. eimzamip · CVSS 7.3 High · Not analysed yet · Published 8 Oct 2026 · Tags: Unrestricted file upload
- [Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter](https://agentprime.io/advisories/CVE-2026-85097.md)
  `CVE-2026-85097` · CVE record: Bricksforge Bricksforge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Unrestricted file upload
- [Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data\[...\]\[files\]\[\]\[subdir\]' Parameter](https://agentprime.io/advisories/CVE-2026-17609.md)
  `CVE-2026-17609` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Unrestricted file upload
- [Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute](https://agentprime.io/advisories/CVE-2026-17196.md)
  `CVE-2026-17196` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Unrestricted file upload
- [Ghost : Stored XSS via SVG Files in Content Imports](https://agentprime.io/advisories/GHSA-hqq2-xqr2-fmx2.md)
  `GHSA-hqq2-xqr2-fmx2`, `BIT-ghost-2026-105644`, `CVE-2026-105644` · npm `ghost`: affected `>=4.0.0, <6.67.0`, fixed in `6.67.0` · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Ghost: Stored XSS via SVG Uploads Bypassing Sanitization](https://agentprime.io/advisories/GHSA-8575-cr6v-7jh4.md)
  `GHSA-8575-cr6v-7jh4`, `BIT-ghost-2026-105649`, `CVE-2026-105649` · npm `ghost`: affected `>=4.22.0, <6.65.0`, fixed in `6.65.0` · CVSS 7.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Payload: Bypassed sanitization of user uploaded SVGs](https://agentprime.io/advisories/GHSA-2pwp-2369-8fg3.md)
  `GHSA-2pwp-2369-8fg3`, `CVE-2026-105862` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Payload: Uploaded XML files could execute same-origin JavaScript](https://agentprime.io/advisories/GHSA-9qpg-3cf8-w33x.md)
  `GHSA-9qpg-3cf8-w33x`, `CVE-2026-105868` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 8.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Unrestricted file upload
- [Ghost: Stored XSS via Bookmark Card Images](https://agentprime.io/advisories/GHSA-347q-26qq-h2p6.md)
  `GHSA-347q-26qq-h2p6`, `BIT-ghost-2026-104413`, `BIT-ghost-2026-105651`, `CVE-2026-104413`, `CVE-2026-105651` · npm `ghost`: affected `>=5.94.0, <6.64.0`, fixed in `6.64.0` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Ghost: Stored XSS via File Uploads on Local Storage](https://agentprime.io/advisories/GHSA-gfjp-2p8f-94qv.md)
  `GHSA-gfjp-2p8f-94qv`, `BIT-ghost-2026-104411`, `BIT-ghost-2026-105679`, `CVE-2026-104411`, `CVE-2026-105679` · npm `ghost`: affected `>=6.22.1, <6.64.0`, fixed in `6.64.0` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution](https://agentprime.io/advisories/GHSA-p279-5wcv-45vq.md)
  `GHSA-p279-5wcv-45vq`, `CVE-2026-104890`, `PKSA-c8mp-7f4z-q7q5`, `PKSA-qzt5-rxz6-8qm6` · Packagist `kunstmaan/bundles-cms` and 1 more: affected `<7.3.2`, fixed in `7.3.2` · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Unrestricted file upload
- [Unrestricted Upload of File with Dangerous Type in BugTracker.NET](https://agentprime.io/advisories/CVE-2026-92532.md)
  `CVE-2026-92532` · CVE record: BugTracker.NET BugTracker.NET · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Unrestricted file upload
- [HortusFox < 6.2 Remote Code Execution via Theme Import](https://agentprime.io/advisories/CVE-2026-104069.md)
  `CVE-2026-104069` · CVE record: danielbrendel hortusfox-web · CVSS 8.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-39770.md)
  `CVE-2026-39770` · CVE record: AmentoTech Doctreat · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-39759.md)
  `CVE-2026-39759` · CVE record: AmentoTech Workreap Core · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-39757.md)
  `CVE-2026-39757` · CVE record: AmentoTech Taskbot · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Unrestricted file upload
- [WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-39755.md)
  `CVE-2026-39755` · CVE record: revmakx WP Duplicate · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-32579.md)
  `CVE-2026-32579` · CVE record: kognetiks Kognetiks Chatbot for WordPress · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Unrestricted file upload
- [ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template](https://agentprime.io/advisories/CVE-2026-105701.md)
  `CVE-2026-105701` · CVE record: Mauro Cassani ACPT (Premium) · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Unrestricted file upload
- [CVE-2026-82988](https://agentprime.io/advisories/CVE-2026-82988.md)
  `CVE-2026-82988` · CVE record: Viewsonic vCast · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, Unrestricted file upload, Insecure deserialization
- [feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-105389.md)
  `CVE-2026-105389` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)](https://agentprime.io/advisories/CVE-2026-105630.md)
  `CVE-2026-105630` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload, CWE-616
- [Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution](https://agentprime.io/advisories/CVE-2026-104811.md)
  `CVE-2026-104811` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection, Unrestricted file upload, CWE-20, CWE-829
- [Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution](https://agentprime.io/advisories/CVE-2026-104805.md)
  `CVE-2026-104805` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Unrestricted file upload, CWE-345, CWE-494
- [W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API](https://agentprime.io/advisories/CVE-2026-105123.md)
  `CVE-2026-105123` · CVE record: vincent-peugnet wcms · CVSS 8.7 High · Not analysed yet · Published 3 Oct 2026 · Tags: Unrestricted file upload
- [Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain](https://agentprime.io/advisories/GHSA-v2f8-6655-7grj.md)
  `GHSA-v2f8-6655-7grj`, `CVE-2026-114108` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Authentication bypass, Unrestricted file upload, Broken access control

Newest: <https://agentprime.io/advisories/tag/file-upload.md>
Older: <https://agentprime.io/advisories/tag/file-upload.md?cursor=WyIyMDI2LTEwLTAyVDIyOjQ0OjI2LjAwMDAwMFoiLCJHSFNBLXYyZjgtNjY1NS03Z3JqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-upload&cursor=WyIyMDI2LTEwLTE1VDIwOjQyOjA0LjcyNjAwMFoiLCJDVkUtMjAyNi0xMDUwMzIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-upload/?cursor=WyIyMDI2LTEwLTE1VDIwOjQyOjA0LjcyNjAwMFoiLCJDVkUtMjAyNi0xMDUwMzIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.