Advisories · Technology

SaturdayDrive Ninja Forms - File Uploads.

Every CVE that names SaturdayDrive Ninja Forms - File Uploads among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-92820 CVE record

CVSS 8.1 High

Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
- SaturdayDrive Ninja Forms - File Uploads
- Unrestricted file upload
Not analysed yet 2 Oct 2026
CVE-2026-12557 CVE record

CVSS 5.3 Medium

Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints
- SaturdayDrive Ninja Forms - File Uploads
- Broken access control
Not analysed yet 3 Jul 2026
CVE-2026-13369 CVE record

CVSS 7.5 High

Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
- SaturdayDrive Ninja Forms - File Uploads
- Path traversal
Not analysed yet 2 Jul 2026
CVE-2026-0740 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
- SaturdayDrive Ninja Forms - File Uploads
- Unrestricted file upload
Not analysed yet 7 Apr 2026
CVE-2024-1596 CVE record

CVSS 7.2 High

Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
- SaturdayDrive Ninja Forms - File Uploads
- Cross-site scripting (XSS)
Not analysed yet 7 Sept 2024
CVE-2022-0888 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload
- SaturdayDrive Ninja Forms - File Uploads
- Unrestricted file upload
Not analysed yet 23 Mar 2022
CVE-2022-0889 CVE record

CVSS 7.2 High

Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
- SaturdayDrive Ninja Forms - File Uploads
- Cross-site scripting (XSS)
Not analysed yet 23 Mar 2022