ModSecurity discloses upload-bypass and crash flaws, one unpatched
One flaw has no listed fix; the pointer bug is reachable only if SecParseXmlIntoArgs is On or OnlyArgs.
Stories per day · 30 days
6 RSS
Relatedremote-code-execution3cisa2kev2wordpress2adobe-commerce1apache1beyondtrust1bricksforge1connect-secure1crystal-server1cve-2026-850971ivanti1magento1metasploit1modsecurity1nginx1nuuo1nvr1
36 stories, newest first · one card per story
Stories tagged #file-upload
Wordfence logs 549 WordPress flaws, including core installer RCE
Seventeen were rated critical; 41 of 549 remain unpatched, and free firewall users get new rules after 30 days.
BeyondTrust Remote Support flaw yields unauthenticated RCE
Rapid7’s Metasploit module writes a PHP file via a forged local router ID and runs it as the site user.
2
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-118527
An authenticated remote attacker can upload chosen files to a known path; the federal due date is November 13.
1
NUUO Crystal Server 3.19.0.85 allows unauthenticated PHP upload to RCE
Uploaded PHP can execute through FastCGI as the web service account, rated 9.8 Critical.
CISA adds exploited Adobe Commerce and Magento upload flaw to KEV
CVE-2026-48356 can run code as the current user; federal agencies must mitigate by November 10.
1
Critical PHP flaws let unauthenticated attackers run code on web servers
CVE-2026-109618 and CVE-2026-109619 score 9.2; only PHP 8.2 and newer get official patches, and Cloudflare reported early attacks.
WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code
Attackers are exploiting unauthenticated Bricksforge flaw CVE-2026-85097 to upload and run arbitrary PHP.
4
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Attackers are exploiting critical Bricksforge flaw CVE-2026-85097 for unauthenticated file upload and code execution.
1
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are exploiting unauthenticated RCE CVE-2026-85097 in the WordPress Bricksforge plugin.
11
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.
7
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
Attackers are exploiting CVE-2026-85097, a CVSS 10 file-upload flaw in the Bricksforge WordPress plugin.
12
[0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H)
Maian Cart 3.8 allows unrestricted banner uploads that become PHP webshells for administrator command execution.
[0day-rubbish] Advantech WebAccess Node 9.2.3 unauthenticated CrystalRpt.aspx file upload and path traversal to code execution in w3wp.exe (9.8)
Unauthenticated file upload and path traversal in Advantech WebAccess Node 9.2.3 can execute code, scored 9.8.
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Maintainers will not fix a Moodle 3.9.2 upload bypass to RCE unless current LTS versions are affected.
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Oss-security thread discusses a Moodle 3.9.2 authenticated file-upload validation bypass (CWE-434) enabling RCE under misconfiguration.
Toptech TMS7 and TopHAT
CISA warns Toptech TMS7 and TopHAT 7.6.3 have critical flaws, including unauthenticated database export.
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Poster questions a CVE for an authenticated Moodle 3.9.2 upload bypass that needs misconfiguration for RCE.
Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Researcher reports an authenticated Moodle 3.9.2 file-upload bypass that can yield RCE if misconfigured.
Hackers Exploit Check Point 0-Day Flaw to Execute Code on Management Servers
Check Point says CVE-2026-93616 is exploited to run code on unauthenticated management servers.
3
[0day-rubbish] Ecava IntegraXor IGX 16.0.701.10 Unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink (9.8)
Unauthenticated file upload in Ecava IntegraXor IGX 16.0.701.10 chains to cmd.exe for Administrator code execution.
SCHUTZWERK-SA-2024-007: Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
Stored XSS in Lumi Education h5p-nodejs-library through 10.0.4 lets uploaded H5P content run JavaScript.
Siemens Siveillance Control
Siemens Siveillance Control OIS flaw lets low-privilege attackers upload files and gain root.
1
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.
2