IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads.
IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.
The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible granted the attacker can obtain a valid nonce. The nonce is exposed in frontend JavaScript making it trivially accessible to unauthenticated attackers.
Airleader Master versions 6.381 and prior allow for file uploads without
restriction to multiple webpages running maximum privileges. This could
allow an unauthenticated user to potentially obtain remote code
execution on the server.
Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. Smart Panel allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Smart Panel: before 20251215.
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process combined with a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using openssl_private_decrypt(), it does not terminate execution and instead passes the boolean false value to the phpseclib library's AES cipher initialization. The library treats this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Additionally, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This makes it possible for unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the wpvivid_action=send_to_site parameter.
CVE-2026-2097 is a high-severity vulnerability in Flowring's Agentflow product that allows authenticated remote attackers to upload arbitrary files without proper restrictions. This unrestricted file upload flaw (CWE-434) enables attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the affected server. The vulnerability requires low privileges and no user interaction, making exploitation relatively straightforward once authentication is obtained. Although no public exploits are currently known, the impact on confidentiality, integrity, and availability is high. European organizations using Agentflow are at risk of server compromise, data breaches, and potential lateral movement within their networks. Mitigation involves implementing strict file upload validation, restricting file types, and applying patches once available. Countries with significant adoption of Flowring products or critical infrastructure using Agentflow are more likely to be targeted. Due to the high CVSS score (8.7) and the nature of the vulnerability, immediate attention is warranted to prevent exploitation.
my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1, the application fails to filter the phar:// protocol in URL validation, allowing attackers to upload a malicious Phar Polyglot file (disguised as JPEG) via the image upload feature, trigger Phar deserialization through BBCode [img] tag processing, and exploit Smarty 4.1.0 POP chain to achieve arbitrary file deletion. This vulnerability is fixed in 20260208.1.
Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server.
This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.
CVE-2026-25056 is a critical vulnerability in the n8n workflow automation platform affecting versions prior to 1.118.0 and 2.4.0. It allows authenticated users with workflow creation or modification permissions to exploit the Merge node's SQL Query mode to write arbitrary files to the server filesystem. This unrestricted file upload can lead to remote code execution without requiring user interaction. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact on confidentiality, integrity, and availability.
The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WP_FOFT_Loader_Mimes::file_and_ext' function in all versions up to, and including, 2.1.39. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2026-1791 is a vulnerability in Hillstone Networks Operation and Maintenance Security Gateway version V5.5ST00001B113 that allows unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to the web server. The vulnerability is categorized under CWE-434 and affects Linux-based deployments of the product. Although the CVSS score is low (2.7) due to the requirement of high privileges and no direct impact on confidentiality or integrity, it can cause availability issues by allowing denial of service or unauthorized code execution. No known exploits are currently reported in the wild. European organizations using this product should be aware of the risk, especially those with critical infrastructure relying on Hillstone security gateways. Mitigation involves applying vendor patches once available, restricting file upload permissions, and monitoring for suspicious file uploads. Countries with higher adoption of Hillstone products and strategic infrastructure reliance on these gateways, such as Germany, France, and the UK, are more likely to be affected. Overall, the threat is low severity but should be addressed promptly to prevent potential exploitation.
CVE-2026-25510 is a critical vulnerability in ci4ms, a CodeIgniter 4-based CMS, allowing authenticated users with file editor permissions to upload and execute arbitrary PHP code via unrestricted file uploads. This leads to Remote Code Execution (RCE) without user interaction. The flaw affects versions prior to 0.28.5.0 and has been patched in that release. Exploitation requires authentication but no additional user interaction. The vulnerability impacts confidentiality, integrity, and availability severely, with a CVSS score of 10. European organizations using ci4ms in their web infrastructure are at risk, especially those with exposed or poorly segmented administrative interfaces. Mitigation involves upgrading to version 0.
CVE-2026-24673 is a medium-severity vulnerability in the Open eClass platform versions prior to 4.2 that allows attackers to bypass file upload restrictions by embedding disallowed file types inside ZIP archives. The platform’s built-in decompression extracts these files without proper validation, enabling potentially dangerous file uploads. Although the vulnerability does not directly impact confidentiality or availability, it can lead to integrity issues if malicious files are uploaded and executed. Exploitation requires network access and low privileges but no user interaction. The issue has been patched in version 4.2. European educational institutions using vulnerable Open eClass versions should prioritize updating to mitigate risks. Countries with widespread adoption of Open eClass and significant educational infrastructure are most at risk. Mitigations include upgrading to version 4.
The OS DataHub Maps plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'OS_DataHub_Maps_Admin::add_file_and_ext' function in all versions up to, and including, 1.8.3. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.
CVE-2025-66480 is a critical path traversal vulnerability in the wildfirechat im-server versions prior to 1.4.3. It arises from improper sanitization of filenames in the file upload endpoint (/fs), allowing attackers to write arbitrary files anywhere on the server filesystem where the application has write permissions. Exploitation can lead to remote code execution by uploading malicious scripts or overwriting critical configuration files. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability without requiring authentication or user interaction. The issue is fixed in version 1.4.3.
An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server.
This issue affects MagicINFO 9 Server: less than 21.1090.1.
A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover
This issue affects MagicINFO 9 Server: less than 21.1090.1.
CVE-2026-24729 is a critical vulnerability in Internet Information Co. , Ltd's DreamMaker product prior to version 2025/10/22. It involves an unrestricted file upload flaw (CWE-434) that allows remote attackers to upload malicious class files without restriction. Exploiting this vulnerability enables attackers to execute arbitrary system commands remotely, without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity with network attack vector, no privileges or user interaction needed, and high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the risk is severe due to the ease of exploitation and potential for full system compromise. European organizations using DreamMaker are at significant risk, especially those in critical infrastructure or sectors relying on this software. Immediate patching or mitigation is essential to prevent exploitation.
