Unrestricted file upload.

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

• WPForms Pro
• Unrestricted file upload

SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

• SUNNET Technology Co., Ltd. Corporate Training Management System
• Unrestricted file upload

WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

• Webの相談所 Really Simple CSV Importer
• Unrestricted file upload

WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability

• MapSVG
• Unrestricted file upload

WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability

• EverPress Mailster
• Unrestricted file upload

GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field

• rtcamp GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more
• Unrestricted file upload

n8n: Edit Image Node Format Injection Allows Arbitrary File Write

• Path traversal
• Unrestricted file upload

<1.123.67 || >=2.0.0-rc.0, <2.31.5 || >=2.32.0, <2.32.1 · fixed in 1.123.67, 2.31.5, 2.32.1

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2

• joomlack.fr Page Builder CK extension for Joomla
• Unrestricted file upload

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

• Unrestricted file upload
• CWE-424

<1.27.0 · fixed in 1.27.0

zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload

• zsadmin2025 ZS-Admin
• Broken access control
• Unrestricted file upload

D-Link DNS-320 multi_uploadify.php unrestricted upload

• D-Link DNS-320
• Broken access control
• Unrestricted file upload

D-Link DNS-320 multi_uploadify.php unrestricted upload

• D-Link DNS-320
• Broken access control
• Unrestricted file upload

D-Link DNS-320 save_ajax.php unrestricted upload

• D-Link DNS-320
• Broken access control
• Unrestricted file upload

D-Link DNS-320 uploadify.php unrestricted upload

• D-Link DNS-320
• Broken access control
• Unrestricted file upload

D-Link DNS-320 uploadify.php unrestricted upload

• D-Link DNS-320
• Broken access control
• Unrestricted file upload

D-Link DNS-320 upload.php unrestricted upload

• D-Link DNS-320
• Broken access control
• Unrestricted file upload

Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload

• Metasoft 美特软件 MetaCRM
• Broken access control
• Unrestricted file upload

FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471

• freescout
• Unrestricted file upload

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

• dj-extensions.com DJ-Classifieds extension for Joomla
• Unrestricted file upload

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6

• dj-extensions.com jDownloads extension for Joomla
• Unrestricted file upload

Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0

• themexpert.com JMedia extension for Joomla
• Unrestricted file upload

HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context

• heyform
• Authentication bypass
• Unrestricted file upload

HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

• heyform
• Cross-site scripting (XSS)
• Unrestricted file upload

Unrestricted Upload of File with Dangerous Type in Windu CMS

• JCD Windu CMS
• Unrestricted file upload

SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload

• SourceCodester Pizzafy Ecommerce System
• Broken access control
• Unrestricted file upload

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

• Unrestricted file upload
• CWE-178

<1.6.0 · fixed in 1.6.0

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

• properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
• Unrestricted file upload

An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/…

• Unrestricted file upload

Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

• Customer Reviews for WooCommerce
• Unrestricted file upload

DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper

• dataease
• Unrestricted file upload

Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass

• grav
• Unrestricted file upload

Kali Forms < 2.4.17 - Unauthenticated Media Upload

• Kali Forms — Contact Form & Drag-and-Drop Builder
• Unrestricted file upload

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

• Path traversal
• Unrestricted file upload

>=2025, <2026.3 · fixed in 2026.3

EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

• Cross-site scripting (XSS)
• Unrestricted file upload

>=5.0.0, <5.0.13 · fixed in 5.0.13

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

• Adobe Commerce
• Adobe Commerce B2B
• Unrestricted file upload

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

• Path traversal
• Broken access control

* · no fixed version yet

code-projects Online Job Portal JobSeekerInsert.php unrestricted upload

• code-projects Online Job Portal
• Broken access control
• Unrestricted file upload

ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

• CRM
• Unrestricted file upload

Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

• Mozilla Firefox for iOS
• Unrestricted file upload

Laravel-Mediable < 7.0.0 File Upload RCE via Extension Bypass

• plank laravel-mediable
• Unrestricted file upload

WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability

• CodeRevolution Aimogen Pro
• Unrestricted file upload

WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability

• quantumcloud WoowBot Pro Max
• Unrestricted file upload

SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload

• SourceCodester Online Book Store System
• Broken access control
• Unrestricted file upload

Ragic｜Enterprise Cloud Database - Arbitrary File Upload

• Ragic Enterprise Cloud Database
• Unrestricted file upload

AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload

• AREA 17 Twill CMS
• Broken access control
• Unrestricted file upload

hcr707305003 shiroiAdmin FileController.php upload unrestricted upload

• hcr707305003 shiroiAdmin
• Broken access control
• Unrestricted file upload

Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

• Unrestricted file upload

<=8.6.83 || >=9.0.0 · no fixed version yet

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

• rsjoomla.com RSFiles extension for Joomla
• Unrestricted file upload

Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3

• phoca.cz Phoca Download extension for Joomla
• Unrestricted file upload

Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()

• wpmessiah Swiss Toolkit For WP
• Unrestricted file upload

NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)

• Path traversal
• Unrestricted file upload

<1.1.0 · fixed in 1.1.0

Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload

• tenteeglobal Instant Appointment
• Unrestricted file upload

Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import

• wpazleen Post Export Import with Media
• Unrestricted file upload

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

• WebRehab Super Forms – Drag & Drop Form Builder
• Unrestricted file upload

Unrestricted file upload in Claris FileMaker Server

• Claris FileMaker Server
• Unrestricted file upload

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

• balbooa.com Balbooa Forms extension for Joomla
• Unrestricted file upload

Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter

• creativethemeshq Blocksy Companion
• Unrestricted file upload

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

• Authentication bypass
• Cross-site request forgery (CSRF)

<0.0.0-20260601151442-5c0ca35db828 · fixed in 0.0.0-20260601151442-5c0ca35db828

Grav - Arbitrary File Upload via Avatar Endpoint

• Grav
• Unrestricted file upload

Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

• Creative Themes Blocksy Companion
• Unrestricted file upload