The CM Map Locations WordPress plugin (up to version 2.1.8) contains an unrestricted file upload vulnerability due to insufficient validation of uploaded files. Authenticated users with subscriber-level access or higher can upload potentially executable files because the upload handler lacks proper MIME-type checks and relies only on incomplete extension filtering. This vulnerability enables remote code execution. The required nonce for upload is accessible to any logged-in subscriber via a JavaScript object on the front-end editor page.
CVE-2026-32559 is a critical vulnerability in tophive UltimateAI versions up to and including 3.1.0 that allows subscribers to upload arbitrary files without restriction on file type. This unrestricted file upload can lead to severe consequences including full system compromise. The vulnerability is classified under CWE-434, indicating improper validation of uploaded files. No official patch or remediation guidance has been provided yet.
CVE-2026-78337 is a vulnerability in Roskus Prospero Flow CRM before version 5.15.13 that allows authenticated users with create and update company permissions to upload SVG files containing embedded scripts. This can lead to arbitrary JavaScript execution within the application origin.
CyberTutor's NewSiteServer (NSS) contains an arbitrary file upload vulnerability allowing unauthenticated remote attackers to upload files of dangerous types, including malicious HTML files. This can lead to effects similar to cross-site scripting attacks. The vulnerability is identified as CWE-434 and has a CVSS 3.1 base score of 6.1, indicating medium severity.
xShop version 3.0.3 contains an Unrestricted File Upload vulnerability that allows an authenticated administrator to upload executable files such as PHP scripts. This flaw enables remote code execution on the server, potentially leading to full system compromise. The issue is fixed in version 3.0.4.
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.
vsDesk version 14.0101 contains a vulnerability in its "Import via CSV" feature where an authenticated administrator can upload arbitrary files due to missing server-side validation. This flaw allows bypassing client-side checks and can lead to remote code execution within the web application context. The vendor has released a patch starting from version 14.0402 to address this issue.
ATutor version 2.2.4 contains a vulnerability in its Gameme module that allows authenticated users to upload files of any type without restriction. Uploaded files are stored in a web-accessible location before validation, enabling an attacker with knowledge of a valid course_id (commonly 0) to upload a malicious script. This can lead to remote code execution with the privileges of the web server process. The product is no longer actively supported, and no fixes are available.
CVE-2026-74018 is a critical vulnerability in themagnifico52's Warehouse Cargo product that allows subscriber-level users to upload arbitrary files without restriction on file type. This issue affects versions up to and including 2.6.9. The vulnerability can lead to complete system compromise due to its high impact on confidentiality, integrity, and availability.
CVE-2026-74016 is a critical vulnerability in themagnifico52 Smart Cleaning versions up to 4.8.6 that allows arbitrary file upload due to unrestricted upload of files with dangerous types. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-74014 is a critical vulnerability in indithemes IT Residence versions up to 3.2.1 that allows subscribers to upload arbitrary files without proper restrictions on file types. This unrestricted file upload flaw can lead to severe consequences including full system compromise.
CVE-2026-66600 is a critical vulnerability in David Lingren's Media LIbrary Assistant allowing authenticated users with high privileges to upload arbitrary files without restriction on file type. This affects versions up to 3.39. The vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-14946 is a high-severity vulnerability in Frauscher Sensortechnik FDS 102 that allows a high privileged remote attacker to upload a .php file due to improper file type validation. This uploaded file can then be accessed directly to execute arbitrary code, potentially leading to full system compromise. The affected versions include 2.8.0 through 2.13.3. No patch or remediation information is currently provided.
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
CVE-2026-68899 is a high-severity vulnerability in Wekan prior to version 9.90 involving unrestricted upload of files with dangerous types. The issue arises because MIME type detection falls back to an attacker-controlled value when the Unix file command is unavailable, allowing authenticated users to upload malicious HTML with JavaScript labeled as safe image/png. This can lead to stored active content execution in the context of the Wekan origin when other users open the file. The vulnerability is fixed in version 9.90 by adding enhanced content inspection to detect dangerous markup.
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
A critical vulnerability (CVE-2026-75949) exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. It allows arbitrary file upload and deletion due to insufficient path containment enforcement and weak file extension checks. Additionally, the upload and removal functions lack CSRF token protection, increasing the risk of unauthorized actions.
An unauthenticated arbitrary file upload vulnerability exists in the Zoo extension for Joomla by yootheme.com, versions 1.0.0 through 4.1.63. The vulnerability arises because the image element accepts arbitrary files when the client-supplied Content-Type is within the image MIME group. This can allow attackers to upload dangerous files without authentication.
CVE-2026-73373 is a critical vulnerability in Joomla! CMS affecting versions 1.0.0 through 5.4.6, 6.0.0 through 6.1.2, 1.0.0 through 3.3.0, and 4.0.0 through 4.2.0. It involves unrestricted upload of SHTML files, which were not included in the default dangerous file list. On servers configured to execute SHTML files, this could lead to remote code execution.