CWE-284
CVEs classified under CWE-284, newest first.
1540 CVEsRSS
CVE-2026-117512High· 7.3oretnom23 php-travel-agency-system employee_insert.php unrestricted upload
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is p…
CVE-2026-82986Medium· 4.6The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
CVE-2026-77171Low· 3.5A public shared collective always allowed recipients of the link to create pages.
A public shared collective always allowed recipients of the link to create pages.
CVE-2026-77173Medium· 4.3A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
CVE-2026-67400Low· 3.5A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
CVE-2026-82984Medium· 4.3When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticate…
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticate…
CVE-2026-92375High· 7.8Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring
An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker…
CVE-2026-90730Medium· 6.5Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
CVE-2026-102789Critical· 9.3Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller,…
CVE-2026-27975Critical· 9.8Ajenti has potential Remote Code Execution
Ajenti has potential Remote Code Execution
CVE-2026-116507Medium· 5.3PoCTOTOLINK A950RG global.so getLanguageCfg information disclosure
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The a…
CVE-2026-116809Medium· 5.3OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous re…
CVE-2026-116603Medium· 4.7SourceCodester Online Food Ordering System add_food.php unrestricted upload
A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be pe…
CVE-2013-10077Medium· 5.3OctoPrint API Key settings.py getSettings information disclosure
A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is p…
CVE-2026-116284Medium· 4.3Kameleo Local API user-info information disclosure
A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be pe…
CVE-2026-116281Low· 3.3Kameleo Profile Controller t.cs ListProfiles information disclosure
A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information d…
CVE-2026-116282Medium· 4.3Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argume…
CVE-2026-116283Medium· 4.3Kameleo Local API profiles information disclosure
A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. …
CVE-2026-116236High· 7.2Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options l…
CVE-2026-103381Medium· 6.5Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to dis…
CVE-2026-103298Medium· 5.3CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on …
CVE-2026-116122Low· 3.7NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is p…
CVE-2026-116113Medium· 6.3GouGuOA Api.php chunkUpload unrestricted upload
A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is p…
CVE-2026-116106High· 7.3PoCHeyCyan App FileProvider access control
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be…
CVE-2026-116108Medium· 4.3openbq-org OpenBB Local API Server api_settings.py access control
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access…
CVE-2026-116044Medium· 6.3prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation le…
CVE-2026-116057Medium· 6.3KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload
A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of …
CVE-2026-87835Medium· 6.5Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership le…
CVE-2026-113674Low· 3.7GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to,…
CVE-2026-106071Low· 3.6PoCnodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radi…