Unrestricted file upload.

10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter

• 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
• Unrestricted file upload

FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist

• error311 FileRise
• Unrestricted file upload

FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

• foliovision FV Flowplayer Video Player
• Unrestricted file upload

JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method

• ntbyk JTL-Connector for WooCommerce
• Unrestricted file upload

AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php

• streetforce1 AGE-GATE
• Unrestricted file upload

Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter

• snazzyplugins Snazzy Social Media Feed
• Unrestricted file upload

Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url

• Printcart Store – Web to Print Product Designer for WooCommerce
• Unrestricted file upload

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Unrestricted file upload

OpenCATS: Authenticated RCE in the Import module

• OpenCATS
• Unrestricted file upload

slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload

• slackero phpwcms
• Broken access control
• Unrestricted file upload

SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload

• SourceCodester Library Management System
• Broken access control
• Unrestricted file upload

SourceCodester E-Learning System Users.php save_users unrestricted upload

• SourceCodester E-Learning System
• Broken access control
• Unrestricted file upload

SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload

• SourceCodester Contact Tracing System
• Broken access control
• Unrestricted file upload

WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile

• WP-BusinessDirectory
• Unrestricted file upload

KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload

• KusalkaSilva Learning-Management-System
• Broken access control
• Unrestricted file upload

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

• Thelia
• Unrestricted file upload

CVE-2026-103535

• Thelia
• Code injection
• Unrestricted file upload

CVE-2026-103529

• Thelia
• Unrestricted file upload

CVE-2026-103522

• Thelia
• Unrestricted file upload

CVE-2026-103521

• Thelia
• Unrestricted file upload

prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload

• prasathmani TinyFileManager
• Broken access control
• Unrestricted file upload

Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process

• Veeqo for WooCommerce
• Unrestricted file upload

Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE

• Anton Extensions
• Unrestricted file upload

WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

• WPFunnels Creator LMS
• Unrestricted file upload

WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

• Tailored Media Tailored Tools
• Unrestricted file upload

WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

• CodeBard Help Desk
• Unrestricted file upload

Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

• Rank Math SEO
• Unrestricted file upload

FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

• foliovision FV Player 8
• Unrestricted file upload

3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

• expivi 3D Product configurator for WooCommerce
• Unrestricted file upload

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload

• htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
• Unrestricted file upload

ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import

• ILIAS
• Unrestricted file upload

HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

• danielbrendel hortusfox-web
• Unrestricted file upload

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

• PX-lab Zombify
• Unrestricted file upload

AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import

• AWP Classifieds
• Unrestricted file upload

Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip

• İzometri IT Services Domestic and Foreign Trade Co. Ltd. eimzamip
• Unrestricted file upload

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

• Bricksforge
• Unrestricted file upload

Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

• WebRehab Super Forms – Drag & Drop Form Builder
• Unrestricted file upload

Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute

• WebRehab Super Forms – Drag & Drop Form Builder
• Unrestricted file upload

Ghost : Stored XSS via SVG Files in Content Imports

• Cross-site scripting (XSS)
• Unrestricted file upload

>=4.0.0, <6.67.0 · fixed in 6.67.0

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

• Cross-site scripting (XSS)
• Unrestricted file upload

>=4.22.0, <6.65.0 · fixed in 6.65.0

Payload: Bypassed sanitization of user uploaded SVGs

• Cross-site scripting (XSS)
• Unrestricted file upload

<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Payload: Uploaded XML files could execute same-origin JavaScript

• Unrestricted file upload

<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Ghost: Stored XSS via Bookmark Card Images

• Cross-site scripting (XSS)
• Unrestricted file upload

>=5.94.0, <6.64.0 · fixed in 6.64.0

Ghost: Stored XSS via File Uploads on Local Storage

• Cross-site scripting (XSS)
• Unrestricted file upload

>=6.22.1, <6.64.0 · fixed in 6.64.0

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

• Unrestricted file upload

<7.3.2 · fixed in 7.3.2

Unrestricted Upload of File with Dangerous Type in BugTracker.NET

• BugTracker.NET
• Unrestricted file upload

HortusFox < 6.2 Remote Code Execution via Theme Import

• danielbrendel hortusfox-web
• Unrestricted file upload

WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

• AmentoTech Doctreat
• Unrestricted file upload

WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability

• AmentoTech Workreap Core
• Unrestricted file upload

WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability

• AmentoTech Taskbot
• Unrestricted file upload

WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability

• revmakx WP Duplicate
• Unrestricted file upload

WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability

• Kognetiks Chatbot for WordPress
• Unrestricted file upload

ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

• Mauro Cassani ACPT (Premium)
• Unrestricted file upload

CVE-2026-82988

• Viewsonic vCast
• Authentication bypass
• Unrestricted file upload

feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload

• feelec-yishu feelcrm-os
• Broken access control
• Unrestricted file upload

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

• plane
• Cross-site scripting (XSS)
• Unrestricted file upload

Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution

• Mitel MiVoice Office 400
• Code injection
• Unrestricted file upload

Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

• Mitel MiVoice Office 400
• Path traversal
• Unrestricted file upload

W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

• vincent-peugnet wcms
• Unrestricted file upload

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

• Information disclosure
• Authentication bypass

>=0.1.0, <0.1.7 · fixed in 0.1.7