On this page
CWE-434: Unrestricted Upload of File with Dangerous Type
Weakness Summary
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- Canonical source: MITRE CWE-434 (opens in a new tab)
- Published Atomicorp CVE observations: 384
- Distinct affected products in those observations: 346
- Active Atomicorp rules associated with this weakness: 111
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2012-10026 | WordPress Asset-Manager PHP File Upload Vulnerability | asset-manager | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2012-10044 | MobileCartly 1.0 Arbitrary File Creation Vulnerability | MobileCartly | Protected by Atomicorp rules | 340087 , 340128 , 380018 , 390801 |
| CVE-2013-10040 | ClipBucket Remote Code Execution | clipbucket | Protected by Atomicorp rules | 336460 , 340128 , 360152 , 380018 , 390801 |
| CVE-2013-10066 | Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload Vulnerability | EDMS | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2020-24186 | WordPress wpDiscuz Unauthenticated File Upload Vulnerability | wpdiscuz | Protected by Atomicorp rules | 340748 , 344360 , 347006 , 382238 , 390709 , 390719 |
| CVE-2024-13981 | LiveBos UploadFile.do Arbitrary File Upload | LiveBOS | Protected by Atomicorp rules | 351000 |
| CVE-2024-56064 | WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE | indeed-wp-superbackup | Protected by Atomicorp rules | 382238 |
| CVE-2025-34040 | Zhiyuan OA - arbitrary file upload leading | Zhiyuan OA Web Application System | Protected by Atomicorp rules | 330791 , 340007 , 340152 |
| CVE-2025-34163 | Dongsheng Logistics Software Unauthenticated Arbitrary File Upload | Dongsheng Logistics Software | Protected by Atomicorp rules | 351000 |
| CVE-2025-47577 | TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload | ti-woocommerce-wishlist | Protected by Atomicorp rules | 382238 |
| CVE-2025-52691 | SmarterTools SmarterMail GUID File Upload Vulnerability | smartermail | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2026-102785 | YOOtheme Pro - Unauthenticated Remote Code Execution via Image Handler | YOOtheme Pro | Protected by Atomicorp rules | 340162 , 340163 , 340165 , 398127 , 398128 |
| CVE-2026-57827 | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 | rsfiles! | Protected by Atomicorp rules | 351000 |
| CVE-2019-4013 | IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload | bigfix platform | Protected by Atomicorp rules | 392301 |
| CVE-2013-0803 | PolarBear CMS PHP File Upload Vulnerability | polarbear cms | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2013-7390 | ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload | manageengine desktop central | Protected by Atomicorp rules | 340128 , 360152 , 380018 , 390801 |
| CVE-2014-8516 | Visual Mining NetCharts Server Remote Code Execution | netcharts server | Protected by Atomicorp rules | 334168 |
| CVE-2014-8739 | Wordpress Creative Contact Form Upload Vulnerability | creative contact form | Protected by Atomicorp rules | 300016 , 330791 , 334168 , 340152 |
| CVE-2015-10135 | WordPress WPshop eCommerce Arbitrary File Upload Vulnerability | wpshop 2 | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2015-10137 | Wordpress N-Media Website Contact Form Upload Vulnerability | website contact form with file upload | Protected by Atomicorp rules | 382238 |
| CVE-2015-10138 | Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload | work the flow file upload | Protected by Atomicorp rules | 351000 |
| CVE-2015-4455 | WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload | aviary image editor add-on for gravity forms | Protected by Atomicorp rules | 340007 , 391742 , 391743 |
| CVE-2015-8249 | ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability | desktop central | Protected by Atomicorp rules | 340007 , 340128 , 344370 , 360152 , 380018 , 390614 , 390801 |
| CVE-2015-9499 | WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE | showbiz pro | Protected by Atomicorp rules | 300019 , 300029 |
| CVE-2016-15042 | WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload | frontend file manager | Protected by Atomicorp rules | 382238 |
| CVE-2016-15043 | WordPress WP Mobile Detector 3.5 Shell Upload | wp mobile detector | Protected by Atomicorp rules | 340128 , 340162 , 340163 , 344370 , 360152 , 380018 , 390801 , 391740 |
| CVE-2016-3088 | ActiveMQ Arbitrary File Write Vulnerability (CVE-2016-3088) | activemq | Protected by Atomicorp rules | 330925 , 340128 , 360152 , 360153 , 380018 , 380026 , 390704 , 390801 , 392301 |
| CVE-2017-16949 | Accesspress Anonymous Post Pro < 3.2.0 - Arbitrary File Upload | anonymous post pro | Detected by Atomicorp rules | 345493 |
| CVE-2017-17976 | PerfexCRM 1.9.7 - Arbitrary File Upload | perfex crm | Protected by Atomicorp rules | 392301 |
| CVE-2017-9101 | PlaySMS import.php Authenticated CSV File Upload Code Execution | playsms | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2018-15961 | Adobe ColdFusion CKEditor unrestricted file upload | coldfusion | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2018-17440 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | Protected by Atomicorp rules | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-20526 | Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal | roxy fileman | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2018-7665 | ClipBucket beats_uploader Unauthenticated Arbitrary File Upload | clipbucket | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2018-9206 | blueimp's jQuery (Arbitrary) File Upload | jquery file upload | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2019-10647 | ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE) | zzzphp | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2020-12800 | WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution | drag and drop multiple file upload - contact form 7 | Protected by Atomicorp rules | 300018 |
| CVE-2020-25213 | WordPress File Manager Unauthenticated Remote Code Execution | file manager | Protected by Atomicorp rules | 344370 , 393781 |
| CVE-2020-28871 | Monitorr unauthenticated Remote Code Execution (RCE) | monitorr | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 340195 , 360152 , 380018 , 390801 , 390811 |
| CVE-2020-36847 | WordPress Simple File List Unauthenticated Remote Code Execution | simple file list | Protected by Atomicorp rules | 340128 , 360152 , 380018 , 382238 , 390700 , 390801 |
| CVE-2020-36849 | WordPress AIT CSV Import Export Unauthenticated Remote Code Execution | csv import / export | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2021-23394 | elFinder < 2.1.58 - Remote Code Execution | elfinder | Protected by Atomicorp rules | 393781 |
| CVE-2021-24212 | WooCommerce Help Scout - Arbitrary File Upload | help scout | Protected by Atomicorp rules | 330791 , 340152 , 382238 |
| CVE-2021-24284 | WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload | kaswara | Protected by Atomicorp rules | 382238 |
| CVE-2021-24499 | WordPress Workreap - Remote Code Execution | workreap | Protected by Atomicorp rules | 330791 , 340152 , 382238 |
| CVE-2021-25003 | WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution | wpcargo track & trace | Detected by Atomicorp rules | 331324 |
| CVE-2021-30118 | Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution | vsa | Protected by Atomicorp rules | 344365 , 392301 |
| CVE-2021-3378 | FortiLogger Arbitrary File Upload Exploit | fortilogger | Protected by Atomicorp rules | 330791 , 340006 , 340152 , 390719 |
| CVE-2021-34624 | WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload | profilepress | Protected by Atomicorp rules | 382238 |
| CVE-2021-43421 | Studio-42 elFinder <2.1.60 - Arbitrary File Upload | elfinder | Protected by Atomicorp rules | 393781 |
| CVE-2021-4449 | ZoomSounds Plugin - Unauthenticated Arbitrary File Upload | zoomsounds | Protected by Atomicorp rules | 392301 |
| CVE-2022-1952 | WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload | free booking plugin for hotels, restaurant and car rental | Protected by Atomicorp rules | 382238 |
| CVE-2022-34128 | GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE) | positions | Protected by Atomicorp rules | 392301 |
| CVE-2022-40471 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | clinic's patient management system | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390501 , 390801 |
| CVE-2022-44276 | responsive filemanager Unrestricted Upload of File with Dangerous Type Vulnerability | responsive filemanager | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2022-47615 | LearnPress Plugin < 4.2.0 - Local File Inclusion | learnpress | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2023-2648 | Weaver E-Office 9.5 - Remote Code Execution | e-office | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2023-27168 | write-back manager Arbitrary Code Execution Vulnerability | write-back manager | Protected by Atomicorp rules | 351000 |
| CVE-2023-3722 | Avaya Aura Device Services - OS Command Injection | aura device services | Protected by Atomicorp rules | 392301 |
| CVE-2023-37629 | Online Piggery Management System v1.0 - Unauthenticated File Upload | simple online piggery management system | Detected by Atomicorp rules | 330791 |
| CVE-2023-4596 | WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload | forminator | Protected by Atomicorp rules | 300006 |
| CVE-2023-51409 | Jordy Meow AI Engine - Unrestricted File Upload | ai engine | Protected by Atomicorp rules | 382238 |
| CVE-2023-5360 | WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload | royal elementor addons | Protected by Atomicorp rules | 382238 |
| CVE-2024-13342 | Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload | booster for woocommerce | Protected by Atomicorp rules | 351000 |
| CVE-2024-23759 | Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability | gambio | Protected by Atomicorp rules | 340095 , 340128 , 344365 , 344370 , 346755 , 360152 , 360153 , 380018 , 390614 , 390801 |
| CVE-2024-25182 | vvvebjs Security Vulnerability | vvvebjs | Protected by Atomicorp rules | 351000 , 390501 |
| CVE-2024-2667 | InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload | instawp connect | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2024-48760 | GestioIP 3.5.7 Remote Command Execution | gestioip | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2024-50623 | Cleo Harmony < 5.8.0.21 - Arbitary File Read | harmony | Protected by Atomicorp rules | 344365 |
| CVE-2024-5084 | WordPress Hash Form Plugin RCE | hash form | Protected by Atomicorp rules | 382238 |
| CVE-2024-6127 | PowerShellEmpire Arbitrary File Upload (Skywalker) | Empire | Protected by Atomicorp rules | 360152 |
| CVE-2024-7399 | Samsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399) | magicinfo 9 server | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2024-8425 | WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload | woocommerce ultimate gift card | Protected by Atomicorp rules | 382238 |
| CVE-2024-8856 | WordPress WP Time Capsule Arbitrary File Upload to RCE | backup and staging by wp time capsule | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2025-12673 | Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload | Flex QR Code Generator | Protected by Atomicorp rules | 351000 |
| CVE-2025-13595 | CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload | CIBELES AI | Protected by Atomicorp rules | 351000 |
| CVE-2025-13597 | AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload | AI Feeds | Protected by Atomicorp rules | 351000 |
| CVE-2025-26319 | FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload | flowise | Atomicorp rules identified for this CVE | 346019 |
| CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader - Deserialization | netweaver | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2025-6058 | WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload | wpbookit | Protected by Atomicorp rules | 382238 |
| CVE-2025-67506 | PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload | pipeshub | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-7441 | WordPress StoryChief Plugin Unauthenticated RCE | StoryChief | Protected by Atomicorp rules | 330791 , 340128 , 340152 , 344370 , 360152 , 380018 , 382238 , 390801 |
| CVE-2025-9314 | Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload | The Developer Tools WordPress plugin through 1.1.3 | Protected by Atomicorp rules | 351000 |
| CVE-2026-0740 | Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload | ninja forms file uploads | Protected by Atomicorp rules | 382238 |
| CVE-2026-103889 | 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter | 3D Product configurator for WooCommerce | Protected by Atomicorp rules | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-110002 | Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter | Snazzy Social Media Feed | Protected by Atomicorp rules | 351000 |
| CVE-2026-14894 | WordPress Super Forms <= 6.3.313 - Arbitrary File Upload | super-forms | Protected by Atomicorp rules | 340748 |
| CVE-2026-18080 | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | Protected by Atomicorp rules | 351000 |
| CVE-2026-2942 | ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess | ProSolution WP Client | Protected by Atomicorp rules | 351000 |
| CVE-2026-3535 | DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter | DSGVO Google Web Fonts GDPR | Protected by Atomicorp rules | 351000 |
| CVE-2026-36669 | ck_upload_handler.php in Feng Office 3.11.13.11 Arbitrary File Upload Vulnerability | ck upload handler.php in Feng Office 3.11.13.11 | Protected by Atomicorp rules | 351000 |
| CVE-2026-3891 | WordPress Unauthenticated RCE via Pix for WooCommerce plugin | Pix for WooCommerce | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2026-4885 | Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload | Piotnet Addons For Elementor Pro | Protected by Atomicorp rules | 351000 |
| CVE-2026-49827 | WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) | WebErpMesv2 | Protected by Atomicorp rules | 351000 |
| CVE-2026-50894 | easyadmin v2.0.2.2 Arbitrary Code Execution Vulnerability | - | Protected by Atomicorp rules | 351000 |
| CVE-2026-67678 | RainyGao-Hithub DocSys v.2.02.80 Arbitrary Code Execution Vulnerability | RainyGao-Hithub DocSys v.2.02.80 | Protected by Atomicorp rules | 351000 |
| CVE-2026-67688 | ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability | ICS-Park Smart Park Management System v2.0 | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71805 | Path Traversal | - | Protected by Atomicorp rules | 351000 |
| CVE-2026-72592 | dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload | phpfm | Protected by Atomicorp rules | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75327 | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java Arbitrary File Upload Vulnerability | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java | Protected by Atomicorp rules | 351000 |
| CVE-2026-85097 | Bricksforge WordPress Plugin <=3.1.8.9 - Unauthenticated Arbitrary File Upload | Bricksforge | Protected by Atomicorp rules | 351000 , 382238 |
| CVE-2026-8778 | MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload | MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields. | Protected by Atomicorp rules | 351000 |
| CVE-2024-31214 | Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809) | traccar | Protected by Atomicorp rules | 330791 , 340006 , 340007 , 340152 , 344360 , 390709 , 390719 |
| CVE-2026-107188 | Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution | Archibus | Protected by Atomicorp rules | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53649 | Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE | joro | Protected by Atomicorp rules | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2013-10043 | Astium Remote Code Execution | VoIP PBX | Protected by Atomicorp rules | 340145 , 340156 , 341145 , 341245 , 390700 |
| CVE-2013-10067 | Glossword v1.8.8 - 1.8.12 Arbitrary File Upload Vulnerability | Glossword | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2025-34104 | Piwik Superuser Plugin Upload | Web Analytics Platform | Protected by Atomicorp rules | 340128 , 360152 , 380018 , 390700 , 390801 |
| CVE-2026-11419 | Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write | on-prem enterprise server | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2009-20006 | osCommerce 2.2 Arbitrary PHP Code Execution | osCommerce | Protected by Atomicorp rules | 320464 , 320465 , 340014 , 340023 , 340029 , 340128 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360152 , 380018 , 390756 , 390801 , 393655 |
| CVE-2012-10027 | WordPress WP-Property PHP File Upload Vulnerability | WordPress Plugin | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2012-10036 | Project Pier Arbitrary File Upload Vulnerability | ProjectPier | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2012-10038 | Auxilium RateMyPet Arbitrary File Upload Vulnerability | RateMyPet | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2012-10045 | XODA 0.4.5 Arbitrary PHP File Upload Vulnerability | XODA | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2012-10049 | WebPageTest Arbitrary PHP File Upload | WebPageTest | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2012-10050 | CuteFlow v2.11.2 Arbitrary File Upload Vulnerability | CuteFlow | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2012-10052 | EGallery PHP File Upload Vulnerability | EGallery | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2012-10054 | Umbraco CMS Remote Command Execution | umbraco cms | Protected by Atomicorp rules | 344360 , 344364 |
| CVE-2013-10034 | Kaseya uploadImage Arbitrary File Upload | KServer | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 347019 , 360152 , 380018 , 390801 |
| CVE-2013-10038 | FlashChat Arbitrary File Upload | FlashChat | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2013-10047 | MiniWeb (Build 300) Arbitrary File Upload | MiniWeb | Protected by Atomicorp rules | 330791 , 340006 , 340152 , 390719 , 398110 |
| CVE-2013-10054 | LibrettoCMS File Manager Arbitary File Upload Vulnerability | LibrettoCMS | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2013-10055 | Havalite CMS Arbitary File Upload Vulnerability | Havalite CMS | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2014-125113 | Dell KACE K1000 File Upload | KACE K1000 Systems Management Appliance | Protected by Atomicorp rules | 340007 , 340128 , 344370 , 360152 , 380018 , 390801 |
| CVE-2014-125116 | HybridAuth install.php PHP Code Execution | HybridAuth | Protected by Atomicorp rules | 340095 , 340128 , 344370 , 346755 , 360152 , 390801 |
| CVE-2016-20052 | Snews CMS 1.7 Unrestricted File Upload via snews_files | snews | Protected by Atomicorp rules | 351000 |
| CVE-2018-25114 | osCommerce 2.3.4.1 - Remote Code Execution | Online Merchant | Protected by Atomicorp rules | 340023 , 340095 , 344360 , 344370 |
| CVE-2022-4995 | Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp | E-cology 9.0 | Protected by Atomicorp rules | 351000 |
| CVE-2023-54405 | H3C CVM Unauthenticated File Upload via fileUpload/upload Token | CVM | Protected by Atomicorp rules | 351000 |
| CVE-2024-14037 | Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob | Red Sea Cloud eHR | Protected by Atomicorp rules | 351000 |
| CVE-2024-58348 | WordPress Background Image Cropper 1.2 Remote Code Execution | Background Image Cropper | Protected by Atomicorp rules | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-34100 | BuilderEngine Arbitrary File Upload Vulnerability and execution | CMS | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 , 399069 |
| CVE-2025-34111 | Tiki Wiki Unauthenticated File Upload Vulnerability | tikiwiki cms/groupware | Protected by Atomicorp rules | 330791 , 340006 , 340152 , 390719 , 393781 |
| CVE-2025-34121 | Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload | Up.Time Monitoring Station | Protected by Atomicorp rules | 340095 , 340128 , 360152 , 380018 , 380026 , 390801 |
| CVE-2026-32985 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import | xerte online toolkits | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2026-35047 | Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint | bravecms | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-44402 | Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi | SNMP Web Pro | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-70558 | Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token | Dinky | Protected by Atomicorp rules | 351000 |
| CVE-2014-125126 | Simple E-Document Arbitrary File Upload | Simple E-Document | Protected by Atomicorp rules | 334168 , 340156 , 390700 |
| CVE-2023-7305 | SmartBI RMIServlet Unrestricted File Upload RCE | SmartBI | Protected by Atomicorp rules | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2021-21351 | XStream Deserialization Remote Command Execution (CVE-2021-21351) | oncommand insight | Protected by Atomicorp rules | 344380 |
| CVE-2026-35573 | ChurchCRM has a Path traversal leads to RCE | churchcrm | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-40484 | ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function | CRM | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-49849 | xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution | xshop | Protected by Atomicorp rules | 351000 |
| CVE-2026-50006 | Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in | anyquery | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390501 , 390709 , 390716 , 390904 , 393655 |
| CVE-2026-58409 | ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload | CRM | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-32475 | Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler | Elementor Pro | Detected by Atomicorp rules | 398001 |
| CVE-2026-40487 | Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS | postiz | Protected by Atomicorp rules | 334168 , 340099 , 341099 |
| CVE-2013-3591 | vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution | vtiger crm | Protected by Atomicorp rules | 316812 , 330791 , 334168 , 340152 , 390700 |
| CVE-2014-9312 | WordPress Photo Gallery Unrestricted File Upload | photo gallery | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2015-10144 | WordPress Responsive Thumbnail Slider Arbitrary File Upload | thumbnail carousel slider | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2015-3884 | qdPM v7 Arbitrary PHP File Upload Vulnerability | qdpm | Protected by Atomicorp rules | 330791 , 334168 , 340133 , 340152 |
| CVE-2015-6000 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340133 , 340152 , 343481 , 360152 , 380018 , 390801 |
| CVE-2017-16524 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 399526 |
| CVE-2017-18048 | Monstra CMS Authenticated Arbitrary File Upload | monstra | Protected by Atomicorp rules | 390700 |
| CVE-2017-6090 | phpCollab 2.5.1 Unauthenticated File Upload | phpcollab | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 391746 |
| CVE-2017-9080 | PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution | playsms | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 390700 |
| CVE-2018-12980 | WAGO e!DISPLAY 7300T - Multiple Vulnerabilities | 762-3000 firmware | Protected by Atomicorp rules | 392301 |
| CVE-2018-17442 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | Protected by Atomicorp rules | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17553 | Navigate CMS Unauthenticated Remote Code Execution | navigate cms | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2018-25171 | EdTv 2 SQL Injection via id Parameter | EdTv | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-10267 | Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload | cloud backup suite | Protected by Atomicorp rules | 340128 , 360152 , 360153 , 380018 , 390801 |
| CVE-2019-15813 | Sentrifugo 3.2 - File Upload Restriction Bypass | sentrifugo | Detected by Atomicorp rules | 345493 |
| CVE-2019-25580 | ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php | owndms | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-8942 | WordPress Crop-image Shell Upload | WordPress | Protected by Atomicorp rules | 340006 , 340007 , 340029 , 340152 , 340748 , 344360 , 347006 , 347009 , 390709 , 390719 |
| CVE-2019-9189 | Prima Access Control 2.3.35 - Arbitrary File Upload | flexair | Protected by Atomicorp rules | 342259 , 344360 , 344363 , 344364 , 344366 , 350147 , 390724 , 390726 , 392647 |
| CVE-2020-27386 | FlexDotnetCMS Arbitrary ASP File Upload | flexdotnetcms | Protected by Atomicorp rules | 340128 , 344370 , 360152 , 380018 , 390801 |
| CVE-2020-27387 | HorizontCMS Arbitrary PHP File Upload | horizontcms | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2020-28328 | SuiteCRM Log File Remote Code Execution | suitecrm | Protected by Atomicorp rules | 330791 , 340014 , 340152 , 341256 , 344362 , 344363 , 344370 |
| CVE-2020-7246 | qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE) | qdpm | Protected by Atomicorp rules | 340006 , 344364 , 344370 , 390719 , 390724 , 390801 |
| CVE-2020-8639 | TestLink 1.9.20 - Unrestricted File Upload (Authenticated) | testlink | Protected by Atomicorp rules | 340007 , 345493 |
| CVE-2021-42362 | Wordpress Popular Posts Authenticated RCE | wordpress popular posts | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2021-42840 | SuiteCRM Log File Remote Code Execution | suitecrm | Protected by Atomicorp rules | 330791 , 340014 , 340152 , 341256 , 344362 , 344363 , 344370 |
| CVE-2021-43258 | ChurchInfo 1.2.13-1.3.0 Authenticated RCE | churchinfo | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2022-1329 | Wordpress Plugin Elementor Authenticated Upload Remote Code Execution | website builder | Protected by Atomicorp rules | 330791 , 340152 , 377360 |
| CVE-2022-2297 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | clinic's patient management system | Protected by Atomicorp rules | 330791 , 334168 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2022-44384 | rConfig Vendors Auth File Upload RCE | rconfig | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2023-36969 | CmsMadeSimple Authenticated File Manager RCE | cms made simple | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2023-38098 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management system | Protected by Atomicorp rules | 334168 , 340156 , 390700 |
| CVE-2023-38836 | BoidCMS Command Injection | boidcms | Protected by Atomicorp rules | 330791 , 340128 , 340152 , 360152 , 380018 , 390801 , 390904 |
| CVE-2023-48777 | WordPress Elementor 3.18.1 - File Upload/Remote Code Execution | website builder | Detected by Atomicorp rules | 377360 |
| CVE-2024-48594 | Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload | prison management system | Protected by Atomicorp rules | 334168 , 340156 , 390700 |
| CVE-2025-11724 | EM Beer Manager <= 3.2.3 - Authenticated (Subscriber+) Arbitrary File Upload | EM Beer Manager | Protected by Atomicorp rules | 351000 |
| CVE-2025-34511 | Sitecore XP CVE-2025-34511 Post-Authentication File Upload | experience commerce | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2025-59710 | biztalk360 Arbitrary Code Execution Vulnerability | biztalk360 | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-65471 | easyimages2.0 Arbitrary Code Execution Vulnerability | easyimages2.0 | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-66449 | ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution | convertx | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-70151 | scholars tracking system Arbitrary Code Execution Vulnerability | scholars tracking system | Protected by Atomicorp rules | 351000 |
| CVE-2025-9216 | StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authent | StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More | Protected by Atomicorp rules | 351000 |
| CVE-2025-9561 | AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallax | AP Background | Protected by Atomicorp rules | 351000 |
| CVE-2026-14498 | Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter | Query Wrangler | Protected by Atomicorp rules | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 |
| CVE-2026-15965 | MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter | MaxUpload – Big File Uploads – Increase Maximum File Upload Size | Protected by Atomicorp rules | 351000 |
| CVE-2026-17196 | Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute | Super Forms – Drag & Drop Form Builder | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904 |
| CVE-2026-18438 | Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Im | Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! | Protected by Atomicorp rules | 351000 |
| CVE-2026-32931 | Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE | chamilo lms | Protected by Atomicorp rules | 351000 |
| CVE-2026-33704 | Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint | chamilo lms | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-41269 | Flowise: File Upload Validation Bypass in createAttachment | flowise | Protected by Atomicorp rules | 351000 |
| CVE-2026-6147 | LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload | LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock | Protected by Atomicorp rules | 351000 |
| CVE-2026-72557 | Cockpit CMS Cockpit CMS - Unrestricted File Upload | Cockpit CMS | Protected by Atomicorp rules | 351000 |
| CVE-2012-10042 | Sflog! CMS 1.0 Arbitrary File Upload Vulnerability | Sflog! CMS | Protected by Atomicorp rules | 330791 , 334168 , 340133 , 340152 |
| CVE-2012-10056 | PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability | PHP Volunteer Management | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2013-10032 | GetSimpleCMS PHP File Upload Vulnerability | getsimplecms | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 390700 , 390801 |
| CVE-2013-10044 | OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution | openemr | Protected by Atomicorp rules | 331028 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 |
| CVE-2014-125138 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via | qEngine CMS | Protected by Atomicorp rules | 351000 |
| CVE-2018-25409 | SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php | SIM-PKH | Protected by Atomicorp rules | 351000 |
| CVE-2019-25673 | UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload | Laravel File Manager | Protected by Atomicorp rules | 351000 |
| CVE-2021-47943 | TextPattern CMS 4.8.7 Remote Code Execution via File Upload | TextPattern CMS | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-103474 | yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE | yii2-starter-kit | Protected by Atomicorp rules | 351000 |
| CVE-2026-105123 | W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API | wcms | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34735 | Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in FileController | wiki | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-40262 | Note Mark has Stored XSS via Unrestricted Asset Upload | note-mark | Protected by Atomicorp rules | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-40488 | OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution | magento | Protected by Atomicorp rules | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-41938 | Vvveb < 1.0.8.2 RCE via Media Upload Handler | Vvveb | Protected by Atomicorp rules | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-55676 | Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component | Malcolm | Protected by Atomicorp rules | 351000 |
| CVE-2026-67206 | Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload | wolfcms | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-68899 | Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback | wekan | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-94104 | NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager | nivocart | Protected by Atomicorp rules | 351000 |
| CVE-2025-34097 | ProcessMaker Plugin Upload | ProcessMaker | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 360152 , 390724 , 390801 |
| CVE-2025-59835 | LangBot has a cross-directory file upload vulnerability, which could lead to system takeover | LangBot | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2025-61678 | FreePBX firmware file upload | endpointman | Protected by Atomicorp rules | 340006 , 344360 , 351000 , 390719 |
| CVE-2026-104471 | YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import | yeswiki | Protected by Atomicorp rules | 351000 |
| CVE-2026-109397 | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space | Thelia | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-23698 | Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload | Vtiger CRM | Protected by Atomicorp rules | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 390904 , 393655 |
| CVE-2026-26212 | Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE | Rara One Click Demo Import | Protected by Atomicorp rules | 351000 |
| CVE-2026-39931 | OpenEMR Authenticated SQL Injection via backup.php Import Feature | openemr | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41587 | CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution | ci4ms | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390501 , 393655 |
| CVE-2026-63429 | HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context | heyform | Protected by Atomicorp rules | 351000 |
| CVE-2026-82524 | UnoPim File Upload RCE via TinyMCE Image Upload Endpoint | unopim | Protected by Atomicorp rules | 351000 |
| CVE-2024-24809 | Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809) | traccar | Protected by Atomicorp rules | 330791 , 340006 , 340007 , 340029 , 340152 , 344360 , 344361 , 344363 , 344364 , 344366 , 350147 , 390709 , 390719 , 391213 |
| CVE-2026-115481 | baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbi | basercms | Protected by Atomicorp rules | 351000 |
| CVE-2026-65986 | CVAT has stored XSS via annotation guide assets | cvat | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 341256 , 342259 , 350147 , 350148 |
| CVE-2026-5695 | Multiple vulnerabilities in the Microweber administration panel | Administration panel | Protected by Atomicorp rules | 351000 |
| CVE-2017-12615 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | Protected by Atomicorp rules | 337209 , 337210 , 337211 , 340095 , 340128 , 344360 , 345493 , 347009 , 380018 , 380026 , 390904 , 392301 |
| CVE-2017-12617 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | Protected by Atomicorp rules | 345493 , 392301 |
| CVE-2025-50286 | Grav CMS Admin Direct Install Authenticated Plugin Upload RCE | grav | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2026-10818 | WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering | WPForms Pro | Protected by Atomicorp rules | 351000 |
| CVE-2026-5718 | Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution | drag-and-drop-multiple-file-upload-contact-form-7 | Protected by Atomicorp rules | 382238 |
| CVE-2026-108101 | HortusFox through 6.3 Unrestricted File Upload via Plant Attachments | hortusfox-web | Protected by Atomicorp rules | 351000 |
| CVE-2025-34086 | Bolt CMS 3.7.0 - Authenticated Remote Code Execution | bolt | Protected by Atomicorp rules | 340007 , 340128 , 344360 , 360152 , 380018 , 390709 , 390801 , 398110 |
| CVE-2026-18983 | One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file | One User Avatar | User Profile Picture | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-53599 | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mo | core | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-82988 | vCast Improper Authentication Vulnerability | vCast | Protected by Atomicorp rules | 351000 |
| CVE-2016-1713 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340133 , 340152 , 343481 , 360152 , 380018 , 390801 |
| CVE-2026-116236 | Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload | Pugongying X5 Pro | Protected by Atomicorp rules | 351000 |
| CVE-2017-1000119 | October CMS Upload Protection Bypass Code Execution | october | Protected by Atomicorp rules | 390700 |
| CVE-2018-1000094 | CMS Made Simple Authenticated RCE via File Upload/Copy | cms made simple | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2018-19422 | Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE | subrion cms | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2020-20969 | PluckCMS 4.7.10 - Unrestricted File Upload | pluck | Protected by Atomicorp rules | 340035 , 390727 , 392301 , 392648 |
| CVE-2020-25042 | MaraCMS Arbitrary PHP File Upload | maracms | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340133 , 340152 , 360152 , 380018 , 390801 |
| CVE-2020-8260 | Pulse Secure VPN gzip RCE | connect secure | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2021-24145 | Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution | modern events calendar lite | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2021-24155 | Wordpress Plugin Backup Guard - Authenticated Remote Code Execution | backup guard | Protected by Atomicorp rules | 330791 , 334168 , 340133 , 340152 , 377360 , 382238 |
| CVE-2021-39352 | Wordpress Plugin Catch Themes Demo Import RCE | catch themes demo import | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2022-3552 | BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) | boxbilling | Protected by Atomicorp rules | 340128 , 380018 |
| CVE-2023-28128 | Ivanti Avalanche FileStoreConfig File Upload | avalanche | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 344365 , 360152 , 380018 , 390801 |
| CVE-2023-47873 | WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload | wp child theme generator | Detected by Atomicorp rules | 377360 |
| CVE-2025-12399 | Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload | Alex Reservations: Smart Restaurant Booking | Protected by Atomicorp rules | 351000 |
| CVE-2025-5961 | WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload | migration, backup, staging | Detected by Atomicorp rules | 377360 |
| CVE-2025-68109 | ChurchCRM Database Restore RCE 6.2.0 | churchcrm | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 390904 |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | Theme Demo Import | Protected by Atomicorp rules | 351000 |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | Everest Toolkit | Protected by Atomicorp rules | 351000 , 382238 , 390501 |
| CVE-2026-27891 | Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | facturascripts | Protected by Atomicorp rules | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-35174 | Chyrp Lite has a Path Traversal to Remote Code Execution | chyrp lite | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-7537 | MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Par | MDJM Event Management | Protected by Atomicorp rules | 351000 |
| CVE-2026-56702 | Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload | adminer | Protected by Atomicorp rules | 351000 |
| CVE-2026-52835 | Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database | Tautulli | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-34336 | eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints | eGovFramework/egovframe-common-components | Protected by Atomicorp rules | 351000 |
| CVE-2026-90603 | Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload | Open-Generative-AI | Protected by Atomicorp rules | 351000 |
| CVE-2021-31207 | Microsoft Exchange ProxyShell RCE | exchange server | Protected by Atomicorp rules | 340095 , 344365 , 344366 , 390716 |
| CVE-2019-8394 | ManageEngine ServiceDesk Plus Arbitrary File Upload | manageengine servicedesk plus | Protected by Atomicorp rules | 340007 , 345493 |
| CVE-2021-24947 | WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read | responsive vector maps | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2026-16548 | Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint | Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat | Protected by Atomicorp rules | 351000 |
| CVE-2026-45797 | HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload | heyform | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-42538 | IRIS has an Insecure File Upload | iris-web | Protected by Atomicorp rules | 351000 |
| CVE-2025-10600 | SourceCodester Online Exam Form Submission register.php unrestricted upload | online exam form submission | Protected by Atomicorp rules | 351000 |
| CVE-2025-11318 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted upload | data leakage prevention system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11656 | ProjectsAndPrograms School Management System editNotes.php unrestricted upload | school management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11657 | ProjectsAndPrograms School Management System createNotice.php unrestricted upload | school management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11658 | ProjectsAndPrograms School Management System changeSllyabus.php unrestricted upload | school management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11659 | ProjectsAndPrograms School Management System uploadNotes.php unrestricted upload | school management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11660 | ProjectsAndPrograms School Management System uploadSllyabus.php unrestricted upload | school management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-12301 | code-projects Simple Food Ordering System editproduct.php unrestricted upload | simple food ordering system | Protected by Atomicorp rules | 351000 |
| CVE-2025-12378 | code-projects Simple Food Ordering System addproduct.php unrestricted upload | simple food ordering system | Protected by Atomicorp rules | 351000 |
| CVE-2025-14583 | campcodes Online Student Enrollment System register.php unrestricted upload | online student enrollment system | Protected by Atomicorp rules | 351000 |
| CVE-2025-15109 | jackq XCMS upload.php unrestricted upload | XCMS | Protected by Atomicorp rules | 351000 |
| CVE-2025-9772 | RemoteClinic edit.php unrestricted upload | remote clinic | Protected by Atomicorp rules | 351000 |
| CVE-2025-9775 | RemoteClinic edit-my-profile.php unrestricted upload | remote clinic | Protected by Atomicorp rules | 351000 |
| CVE-2026-0643 | projectworlds House Rental and Property Listing Signup register.php unrestricted upload | house rental and property listing project | Protected by Atomicorp rules | 351000 |
| CVE-2026-104637 | onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload | HospitalManagementSystem | Protected by Atomicorp rules | 351000 , 390501 |
| CVE-2026-11344 | code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload | Vehicle Management System | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-114259 | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload | file-management-system-php | Protected by Atomicorp rules | 351000 |
| CVE-2026-11474 | Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload | student-management-system | Protected by Atomicorp rules | 351000 , 393655 |
| CVE-2026-117512 | oretnom23 php-travel-agency-system employee_insert.php unrestricted upload | php-travel-agency-system | Protected by Atomicorp rules | 351000 |
| CVE-2026-13553 | itsourcecode Online Hotel Management System controller.php add unrestricted upload | Online Hotel Management System | Protected by Atomicorp rules | 351000 |
| CVE-2026-14736 | Ruijie RG-UAC user_auth_commit.php unrestricted upload | RG-UAC | Protected by Atomicorp rules | 351000 |
| CVE-2026-18788 | Trippo ResponsiveFilemanager dialog.php unrestricted upload | ResponsiveFilemanager | Protected by Atomicorp rules | 351000 |
| CVE-2026-5261 | Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload | InforCenter PLM | Protected by Atomicorp rules | 351000 |
| CVE-2026-54611 | InstantCMS has Remote Code Execution in package installer | icms2 | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-5573 | Technostrobe HI-LED-WR120-G2 fs unrestricted upload | hi-led-wr120-g2 firmware | Protected by Atomicorp rules | 351000 |
| CVE-2026-6602 | rickxy Hospital Management System his_admin_account.php unrestricted upload | Hospital Management System | Protected by Atomicorp rules | 351000 |
| CVE-2026-78202 | itsourcecode Payroll System admin_class.php save_settings unrestricted upload | Payroll System | Protected by Atomicorp rules | 351000 |
| CVE-2026-78245 | itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload | Online Pharmacy System | Protected by Atomicorp rules | 351000 |
| CVE-2026-85208 | itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload | Online Medicine Delivery System | Protected by Atomicorp rules | 351000 |
| CVE-2026-86239 | liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload | FeehiCMS | Protected by Atomicorp rules | 351000 |
| CVE-2026-86305 | light0011 cms Upload.class.php upload unrestricted upload | cms | Protected by Atomicorp rules | 351000 |
| CVE-2026-86666 | aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload | iWebShop-5 | Protected by Atomicorp rules | 351000 |
| CVE-2026-8758 | Metasoft 美特软件 MetaCRM upload3.jsp unrestricted upload | MetaCRM | Protected by Atomicorp rules | 351000 |
| CVE-2023-3187 | Teachers Record Management System 1.0 - File Upload Type Validation | teachers record management system | Detected by Atomicorp rules | 345493 |
| CVE-2026-36722 | bookcars v8.3 Arbitrary Code Execution Vulnerability | bookcars v8.3 | Protected by Atomicorp rules | 351000 |
| CVE-2026-59188 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer | Part-DB-server | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15152 | h-moses moga-mall PmsProductController.java addProduct unrestricted upload | moga-mall | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-55419 | Reachy Mini: Unrestricted Upload of File with Dangerous Type | reachy mini | Protected by Atomicorp rules | 351000 |
| CVE-2026-78337 | Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG | Prospero Flow CRM | Protected by Atomicorp rules | 351000 |
| CVE-2026-79670 | Ech0 before 4.4.3 Stored XSS via SVG Upload | Ech0 | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-81931 | Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting | Prospero Flow CRM | Protected by Atomicorp rules | 351000 |
| CVE-2026-75331 | tamguo 1.5.3 Cross-Site Scripting Vulnerability | - | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-14046 | OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload | OpenBoxes | Protected by Atomicorp rules | 351000 |
| CVE-2025-11078 | itsourcecode Open Source Job Portal controller.php unrestricted upload | open source job portal | Protected by Atomicorp rules | 351000 |
| CVE-2025-11320 | zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload | wisdom-education | Protected by Atomicorp rules | 351000 |
| CVE-2025-11351 | code-projects Online Hotel Reservation System editpicexec.php unrestricted upload | online hotel reservation system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11352 | code-projects Online Hotel Reservation System addexec.php unrestricted upload | online hotel reservation system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11353 | code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload | online hotel reservation system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11354 | code-projects Online Hotel Reservation System addslideexec.php unrestricted upload | online hotel reservation system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11398 | SourceCodester Hotel and Lodge Management System Profile profile.php unrestricted upload | hotel and lodge management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11417 | Campcodes Advanced Online Voting Management System voters_add.php unrestricted upload | advanced online voting system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11426 | projectworlds Advanced Library Management System edit_book.php unrestricted upload | advanced library management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-11908 | Shenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted upload | streamax crocus | Protected by Atomicorp rules | 351000 |
| CVE-2025-12346 | MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload | maxsite cms | Protected by Atomicorp rules | 351000 |
| CVE-2025-12347 | MaxSite CMS save-file-ajax.php unrestricted upload | maxsite cms | Protected by Atomicorp rules | 351000 |
| CVE-2025-12862 | projectworlds Online Notes Sharing Platform userprofile.php unrestricted upload | online notes sharing platform | Protected by Atomicorp rules | 351000 |
| CVE-2025-13061 | itsourcecode Online Voting System index.php unrestricted upload | online voting system | Protected by Atomicorp rules | 351000 |
| CVE-2025-13238 | Bdtask Flight Booking Software Edit Profile edit unrestricted upload | flight booking software | Protected by Atomicorp rules | 351000 |
| CVE-2025-13573 | projectworlds can pass malicious payloads add_book.php unrestricted upload | advanced library management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-13815 | moxi159753 Mogu Blog v2 pictures unrestricted upload | mogublog | Protected by Atomicorp rules | 351000 |
| CVE-2025-13949 | ProudMuBai GoFilm FileController.go SingleUpload unrestricted upload | GoFilm | Protected by Atomicorp rules | 351000 |
| CVE-2025-14195 | code-projects Employee Profile Management System add_file_query.php unrestricted upload | employee profile management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-14522 | baowzh hfly upload_json.php unrestricted upload | hfly | Protected by Atomicorp rules | 351000 |
| CVE-2025-15050 | code-projects Student File Management System save_file.php unrestricted upload | student file management system | Protected by Atomicorp rules | 351000 |
| CVE-2025-15423 | EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload | empirecms | Protected by Atomicorp rules | 351000 |
| CVE-2025-9800 | SimStudioAI sim HTML File route.ts import unrestricted upload | sim | Protected by Atomicorp rules | 351000 |
| CVE-2026-101071 | Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload | Unet Web Service | Protected by Atomicorp rules | 351000 |
| CVE-2026-10172 | Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload | Multi-Store Inventory Management System | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-102366 | mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints | mall4j | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103541 | formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload | Form Tools | Protected by Atomicorp rules | 351000 |
| CVE-2026-105389 | feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload | feelcrm-os | Protected by Atomicorp rules | 351000 |
| CVE-2026-10806 | mjperpinosa stumasy add_post.php unrestricted upload | stumasy | Protected by Atomicorp rules | 351000 |
| CVE-2026-10807 | mjperpinosa stumasy change_profile_image.php unrestricted upload | stumasy | Protected by Atomicorp rules | 351000 |
| CVE-2026-116057 | KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload | KodExplorer | Protected by Atomicorp rules | 351000 |
| CVE-2026-116113 | GouGuOA Api.php chunkUpload unrestricted upload | GouGuOA | Protected by Atomicorp rules | 351000 |
| CVE-2026-14698 | SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload | Syllabus-Aligned Learning Management and Examination System | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-14776 | SourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted | Onlne Examination & Learning Management System | Protected by Atomicorp rules | 351000 |
| CVE-2026-14777 | SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload | Onlne Examination & Learning Management System | Protected by Atomicorp rules | 351000 |
| CVE-2026-16451 | zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload | ZS-Admin | Protected by Atomicorp rules | 351000 |
| CVE-2026-19210 | SourceCodester Photo Share Website ajax.php save_upload unrestricted upload | Photo Share Website | Protected by Atomicorp rules | 351000 |
| CVE-2026-5670 | Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload | Student-Management-System | Protected by Atomicorp rules | 351000 |
| CVE-2026-6489 | QueryMine sms Background Management addteacher.php unrestricted upload | sms | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7107 | code-projects Invoice System in Laravel company unrestricted upload | Invoice System in Laravel | Protected by Atomicorp rules | 351000 |
| CVE-2026-7732 | code-projects BloodBank Managing System request_blood.php unrestricted upload | BloodBank Managing System | Protected by Atomicorp rules | 351000 |
| CVE-2026-77681 | CodeAstro Online Job Portal update-profile.php unrestricted upload | Online Job Portal | Protected by Atomicorp rules | 351000 |
| CVE-2026-82679 | diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload | diem | Protected by Atomicorp rules | 351000 |
| CVE-2026-85186 | itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload | Online Medicine Delivery System | Protected by Atomicorp rules | 351000 |
| CVE-2026-90500 | lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload | vhr | Protected by Atomicorp rules | 351000 |
| CVE-2026-90857 | SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload | College Notes Gallery Management System | Protected by Atomicorp rules | 351000 |
| CVE-2026-91005 | SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted u | Online Faculty Clearance System | Protected by Atomicorp rules | 351000 |
| CVE-2026-91849 | WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload | WuzhiCMS | Protected by Atomicorp rules | 351000 |
| CVE-2025-11103 | Projectworlds Online Tours and Travels change-image.php unrestricted upload | online tours and travels | Protected by Atomicorp rules | 351000 |
| CVE-2025-11136 | YiFang CMS Backend File.php webUploader unrestricted upload | yifang | Protected by Atomicorp rules | 351000 |
| CVE-2025-11508 | code-projects Voting System voters_add.php unrestricted upload | voting system | Protected by Atomicorp rules | 351000 |
| CVE-2025-12593 | code-projects Simple Online Hotel Reservation System Photo edit_room.php unrestricted upload | simple online hotel reservation system | Protected by Atomicorp rules | 351000 |
| CVE-2025-13185 | Bdtask/CodeCanyon News365 profile unrestricted upload | news365 | Protected by Atomicorp rules | 351000 |
| CVE-2025-13198 | DouPHP file.class.php unrestricted upload | DouPHP | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-14219 | Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload | retro basketball shoes online store | Protected by Atomicorp rules | 351000 |
| CVE-2025-14530 | SourceCodester Real Estate Property Listing App property.php unrestricted upload | real estate property listing app | Protected by Atomicorp rules | 351000 |
| CVE-2025-14582 | campcodes Online Student Enrollment System index.php unrestricted upload | online student enrollment system | Protected by Atomicorp rules | 351000 |
| CVE-2025-15110 | jackq XCMS Backend ProductImageController.class.php upload unrestricted upload | xcms | Protected by Atomicorp rules | 351000 |
| CVE-2025-15197 | code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload | news-buzz | Protected by Atomicorp rules | 351000 |
| CVE-2026-116603 | SourceCodester Online Food Ordering System add_food.php unrestricted upload | Online Food Ordering System | Protected by Atomicorp rules | 351000 |
| CVE-2026-15518 | AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload | Twill CMS | Protected by Atomicorp rules | 351000 |
| CVE-2026-19383 | saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload | SaiAdmin | Protected by Atomicorp rules | 351000 |
| CVE-2026-19839 | SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload | Simple Doctors Appointment System | Protected by Atomicorp rules | 351000 |
| CVE-2026-5576 | SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload | Record Management System | Protected by Atomicorp rules | 340156 , 341245 , 351000 , 390501 |
| CVE-2026-7238 | code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload | Online Music Site | Protected by Atomicorp rules | 351000 |
| CVE-2026-76995 | SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload | Simple Online Food Ordering System | Protected by Atomicorp rules | 351000 |
| CVE-2026-82629 | jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload | jeewx-boot | Protected by Atomicorp rules | 351000 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 300006 | Active | disruptive (deny) |
| 300016 | Active | disruptive (deny) |
| 300018 | Active | disruptive (deny) |
| 300019 | Active | disruptive (deny) |
| 300029 | Active | disruptive (deny) |
| 316812 | Active | disruptive (deny) |
| 320464 | Active | disruptive (deny) |
| 320465 | Active | disruptive (deny) |
| 330791 | Active | disruptive (deny) |
| 330925 | Active | disruptive (deny) |
| 331028 | Active | disruptive (deny) |
| 331324 | Active | non-disruptive (pass) |
| 333140 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 336460 | Active | disruptive (deny) |
| 337209 | Active | disruptive (deny) |
| 337210 | Active | disruptive (deny) |
| 337211 | Active | disruptive (deny) |
| 340006 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340016 | Active | disruptive (deny) |
| 340017 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340035 | Active | disruptive (deny) |
| 340087 | Active | disruptive (deny) |
| 340095 | Active | disruptive (deny) |
| 340099 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340133 | Active | disruptive (deny) |
| 340144 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 340157 | Active | disruptive (deny) |
| 340162 | Active | disruptive (deny) |
| 340163 | Active | disruptive (deny) |
| 340165 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 340195 | Active | disruptive (deny) |
| 340748 | Active | disruptive (deny) |
| 341099 | Active | disruptive (deny) |
| 341145 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 341266 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 343481 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344362 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344365 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 344380 | Active | disruptive (deny) |
| 345493 | Active | non-disruptive (pass) |
| 346019 | Retired | non-disruptive (not available) |
| 346755 | Active | disruptive (deny) |
| 347006 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 347019 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 351000 | Active | disruptive (deny) |
| 360029 | Active | disruptive (deny) |
| 360147 | Active | disruptive (deny) |
| 360148 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 360153 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 380018 | Active | disruptive (deny) |
| 380026 | Active | disruptive (deny) |
| 380122 | Active | disruptive (deny) |
| 382238 | Active | disruptive (deny) |
| 390501 | Active | disruptive (deny) |
| 390572 | Active | disruptive (deny) |
| 390585 | Active | disruptive (deny) |
| 390614 | Active | disruptive (deny) |
| 390700 | Active | disruptive (deny) |
| 390704 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390724 | Active | disruptive (deny) |
| 390726 | Active | disruptive (deny) |
| 390727 | Active | disruptive (deny) |
| 390756 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
| 390811 | Active | disruptive (deny) |
| 390904 | Active | disruptive (deny) |
| 391213 | Active | disruptive (deny) |
| 391740 | Active | disruptive (deny) |
| 391742 | Active | disruptive (deny) |
| 391743 | Active | disruptive (deny) |
| 391746 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 392647 | Active | disruptive (deny) |
| 392648 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
| 393781 | Active | disruptive (deny) |
| 398001 | Active | non-disruptive (pass) |
| 398110 | Active | disruptive (deny) |
| 398127 | Active | disruptive (deny) |
| 398128 | Active | disruptive (deny) |
| 399069 | Active | disruptive (deny) |
| 399526 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims: