agentprime: Unrestricted file uploadEvery new Unrestricted file upload Advisory and CVE.https://agentprime.io/CVE-2026-122047: Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-122047/https://agentprime.io/advisories/CVE-2026-122047/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:45:20 GMTCVECVE-2026-122120: Unrestricted file upload in Yealink Plug-in Softwareshttps://agentprime.io/advisories/CVE-2026-122120/https://agentprime.io/advisories/CVE-2026-122120/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:00:46 GMTCVEcriticalCVE-2026-115243: WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_fileshttps://agentprime.io/advisories/CVE-2026-115243/https://agentprime.io/advisories/CVE-2026-115243/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:00:26 GMTCVECVE-2026-121733: Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Uploadhttps://agentprime.io/advisories/CVE-2026-121733/https://agentprime.io/advisories/CVE-2026-121733/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 22:55:37 GMTCVECVE-2026-73328: Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/https://agentprime.io/advisories/CVE-2026-73328/https://agentprime.io/advisories/CVE-2026-73328/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:17:18 GMTCVECVE-2026-76124: BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpointhttps://agentprime.io/advisories/CVE-2026-76124/https://agentprime.io/advisories/CVE-2026-76124/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 12:31:54 GMTCVECVE-2026-120534: Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Typehttps://agentprime.io/advisories/CVE-2026-120534/https://agentprime.io/advisories/CVE-2026-120534/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 04:43:09 GMTCVEcriticalCVE-2026-105606: Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8https://agentprime.io/advisories/CVE-2026-105606/https://agentprime.io/advisories/CVE-2026-105606/CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:01:44 GMTCVEcriticalCVE-2026-105603: Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3https://agentprime.io/advisories/CVE-2026-105603/https://agentprime.io/advisories/CVE-2026-105603/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 18:25:29 GMTCVEcriticalCVE-2026-76010: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversalhttps://agentprime.io/advisories/CVE-2026-76010/https://agentprime.io/advisories/CVE-2026-76010/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 09:29:25 GMTCVECVE-2026-118235: SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_datahttps://agentprime.io/advisories/CVE-2026-118235/https://agentprime.io/advisories/CVE-2026-118235/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 08:30:45 GMTCVEcriticalCVE-2026-116512: Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injectionhttps://agentprime.io/advisories/CVE-2026-116512/https://agentprime.io/advisories/CVE-2026-116512/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 07:46:51 GMTCVEcriticalCVE-2026-119620: 37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-119620/https://agentprime.io/advisories/CVE-2026-119620/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 17:45:15 GMTCVECVE-2026-76012: Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Uploadhttps://agentprime.io/advisories/CVE-2026-76012/https://agentprime.io/advisories/CVE-2026-76012/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 17:15:33 GMTCVECVE-2026-115346: Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Fieldhttps://agentprime.io/advisories/CVE-2026-115346/https://agentprime.io/advisories/CVE-2026-115346/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 17:15:31 GMTCVECVE-2026-61738: SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)https://agentprime.io/advisories/CVE-2026-61738/https://agentprime.io/advisories/CVE-2026-61738/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:36:10 GMTCVEcriticalCVE-2025-68391: Arbitrary File Upload in Protectelhttps://agentprime.io/advisories/CVE-2025-68391/https://agentprime.io/advisories/CVE-2025-68391/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:37:29 GMTCVECVE-2026-61645: Docat has Arbitrary File Upload exists in Upload APIhttps://agentprime.io/advisories/CVE-2026-61645/https://agentprime.io/advisories/CVE-2026-61645/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 21:17:37 GMTCVEcriticalParse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklisthttps://agentprime.io/advisories/GHSA-r899-h629-j84r/https://agentprime.io/advisories/GHSA-r899-h629-j84r/parse-server <8.6.84 || >=9.0.0, <9.10.0-alpha.2, fixed in 8.6.84, 9.10.0-alpha.2. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 29 Oct 2026 16:33:48 GMTnpmparse-serverCVE-2026-90866: Virtual Folder Path Confinement Bypass in Progress WS_FTP Serverhttps://agentprime.io/advisories/CVE-2026-90866/https://agentprime.io/advisories/CVE-2026-90866/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:52:24 GMTCVEcriticalCVE-2026-90864: Host Administrator Path Containment Bypass in Progress WS_FTP Serverhttps://agentprime.io/advisories/CVE-2026-90864/https://agentprime.io/advisories/CVE-2026-90864/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:50:29 GMTCVEcriticalCVE-2026-115245: Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Uploadhttps://agentprime.io/advisories/CVE-2026-115245/https://agentprime.io/advisories/CVE-2026-115245/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:00:26 GMTCVEcriticalCVE-2026-16889: Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Originhttps://agentprime.io/advisories/CVE-2026-16889/https://agentprime.io/advisories/CVE-2026-16889/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 01:32:09 GMTCVECVE-2026-67073: HCL BigFix AEX is affected by multiple security vulnerabilities.https://agentprime.io/advisories/CVE-2026-67073/https://agentprime.io/advisories/CVE-2026-67073/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 12:24:30 GMTCVECVE-2026-109218: Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypasshttps://agentprime.io/advisories/CVE-2026-109218/https://agentprime.io/advisories/CVE-2026-109218/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 06:45:19 GMTCVEcriticalCVE-2026-109384: The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Uploadhttps://agentprime.io/advisories/CVE-2026-109384/https://agentprime.io/advisories/CVE-2026-109384/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 06:45:12 GMTCVECVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Uploadhttps://agentprime.io/advisories/CVE-2026-103688/https://agentprime.io/advisories/CVE-2026-103688/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 06:00:20 GMTCVEcriticalCVE-2026-111255: affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameterhttps://agentprime.io/advisories/CVE-2026-111255/https://agentprime.io/advisories/CVE-2026-111255/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 03:42:53 GMTCVECVE-2026-84999: Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handlerhttps://agentprime.io/advisories/CVE-2026-84999/https://agentprime.io/advisories/CVE-2026-84999/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 02:29:57 GMTCVEcriticalCVE-2026-117607: Xerte Online Toolkits through 3.15.5 RCE via Language Pack Importhttps://agentprime.io/advisories/CVE-2026-117607/https://agentprime.io/advisories/CVE-2026-117607/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 02:03:16 GMTCVECVE-2014-125138: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fieldshttps://agentprime.io/advisories/CVE-2014-125138/https://agentprime.io/advisories/CVE-2014-125138/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 02:03:13 GMTCVECVE-2026-117512: oretnom23 php-travel-agency-system employee_insert.php unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-117512/https://agentprime.io/advisories/CVE-2026-117512/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 16:30:18 GMTCVECVE-2026-4337: Unrestricted Upload of File in PuMuKIT applicationhttps://agentprime.io/advisories/CVE-2026-4337/https://agentprime.io/advisories/CVE-2026-4337/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 11:03:15 GMTCVECVE-2026-116603: SourceCodester Online Food Ordering System add_food.php unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-116603/https://agentprime.io/advisories/CVE-2026-116603/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 23:30:13 GMTCVECVE-2026-115188: An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.https://agentprime.io/advisories/CVE-2026-115188/https://agentprime.io/advisories/CVE-2026-115188/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 12:33:54 GMTCVEcriticalCVE-2026-116236: Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-116236/https://agentprime.io/advisories/CVE-2026-116236/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 09:00:21 GMTCVECVE-2026-116113: GouGuOA Api.php chunkUpload unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-116113/https://agentprime.io/advisories/CVE-2026-116113/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 03:15:16 GMTCVECVE-2026-116057: KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-116057/https://agentprime.io/advisories/CVE-2026-116057/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 15:30:13 GMTCVECVE-2026-116044: prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-116044/https://agentprime.io/advisories/CVE-2026-116044/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 05:45:16 GMTCVECVE-2026-115481: baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file uploadhttps://agentprime.io/advisories/CVE-2026-115481/https://agentprime.io/advisories/CVE-2026-115481/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 13:34:26 GMTCVECVE-2026-113472: Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Uploadhttps://agentprime.io/advisories/CVE-2026-113472/https://agentprime.io/advisories/CVE-2026-113472/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 06:00:19 GMTCVECVE-2026-59188: Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewerhttps://agentprime.io/advisories/CVE-2026-59188/https://agentprime.io/advisories/CVE-2026-59188/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 03:59:11 GMTCVECVE-2026-54630: Part-DB: Authenticated RCE via .phar attachment upload served from public/mediahttps://agentprime.io/advisories/CVE-2026-54630/https://agentprime.io/advisories/CVE-2026-54630/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 03:48:59 GMTCVEcriticalCVE-2026-102785: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52https://agentprime.io/advisories/CVE-2026-102785/https://agentprime.io/advisories/CVE-2026-102785/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 12:36:43 GMTCVEcriticalCVE-2026-114262: file-management-system FileController.php store unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-114262/https://agentprime.io/advisories/CVE-2026-114262/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 17:15:14 GMTCVECVE-2026-114259: oretnom23 file-management-system-php admin_class.php save_files unrestricted uploadhttps://agentprime.io/advisories/CVE-2026-114259/https://agentprime.io/advisories/CVE-2026-114259/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 16:30:19 GMTCVECVE-2026-111832: WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerabilityhttps://agentprime.io/advisories/CVE-2026-111832/https://agentprime.io/advisories/CVE-2026-111832/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 14:00:13 GMTCVEcriticalCVE-2026-111834: WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerabilityhttps://agentprime.io/advisories/CVE-2026-111834/https://agentprime.io/advisories/CVE-2026-111834/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 14:00:13 GMTCVEcriticalCVE-2026-114398: Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogohttps://agentprime.io/advisories/CVE-2026-114398/https://agentprime.io/advisories/CVE-2026-114398/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 12:39:52 GMTCVECVE-2026-87800: IBM Cyber Fraud includes components with multiple known vulnerabilitieshttps://agentprime.io/advisories/CVE-2026-87800/https://agentprime.io/advisories/CVE-2026-87800/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:53:18 GMTCVE