An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
CVE-2026-96515 is a high-severity vulnerability in the Netlink ICT HG323RW router caused by missing authorization and insufficient input validation in the diagnostic script import feature. An authenticated attacker can upload and execute a crafted script via the web management interface, leading to arbitrary command execution with root privileges and full device compromise.
CVE-2026-5695 is an arbitrary file upload vulnerability in the Microweber Administration panel version 2.0.19. It arises from insufficient validation in upload forms, allowing authenticated users to upload files without restriction. This flaw can be exploited to execute malicious code remotely, potentially leading to full system compromise. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.4. No patch or official remediation information is provided in the available data.
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress contain an arbitrary file upload vulnerability in versions 2.0 through 3.8.3. This flaw allows authenticated users with subscriber-level access or higher to upload files without proper validation of file type or content. The vulnerability arises from the download_file_to_uploads function, which registers an import action for unauthenticated users and lacks capability checks and MIME type validation. This can lead to remote code execution if malicious executable files are uploaded.
HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.
Chamilo LMS versions prior to 2.0.1 contain a critical path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability is fixed in version 2.0.1. The advisory does not specify the affected endpoint or exploitation details. The CVSS score is 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.
CVE-2026-76552 is a vulnerability in the WP Import Export Lite WordPress plugin versions before 3.9.33. The plugin fails to validate the type, extension, or content of files retrieved from user-supplied URLs during import. This allows users with import permissions to upload arbitrary files, including executable ones, to the server, potentially leading to remote code execution.
The Contest Gallery plugin for WordPress, used for uploading and voting on photos and media, contains a vulnerability allowing authenticated users with subscriber-level access or higher to overwrite arbitrary files due to insufficient validation of the 'baseUrlForFacebook' parameter. This flaw exists in all versions up to and including 32.0.1 and can lead to remote code execution under certain conditions.
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Dell Wyse Management Suite versions prior to 2605.0.3.683 contain a vulnerability allowing unrestricted upload of files with dangerous types. This flaw could be exploited by an unauthenticated remote attacker to achieve remote code execution. The vulnerability is identified as CWE-434 and has a high severity with a CVSS score of 8.6. A fixed version, 2605.0.3.683, has been released to address this issue.
Dell Wyse Management Suite versions prior to 2605.0.3.683 contain a vulnerability allowing unrestricted upload of files with dangerous types. This flaw could be exploited remotely by an unauthenticated attacker, potentially leading to remote code execution. The vulnerability is identified as CWE-434 and carries a high severity with a CVSS score of 8.6.
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the withFiles() path through FileNameGenerator do not internally reject server-executable file types. An authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field without mimes: and mimetypes: validation when the public disk is web-accessible through php artisan storage:link and the web-server and PHP-FPM configuration executes the stored extension. The legacy path preserves an accepted extension and the newer path derives an extension without blocking dangerous types. The package-level restriction is defense in depth and does not replace application-level upload validation. This issue is fixed in versions 6.8.14 and 7.0.38.