CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Joomla Balbooa Forms Extension Unauthenticated Remote Code Execution Vulnerability (CVE-2026-56291)
[Affected Scope] Joomla Balbooa Forms extension versions prior to 2.4.1
[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full Remote Code Execution (RCE) and complete compromise of the web server
[Mitigation] Immediately upgrade the Balbooa Forms extension to version 2.4.1 or higher, and disable script execution in upload directories
Joomla Page Builder CK Extension Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-56290)
[Affected Scope] Joomla Page Builder CK extension versions prior to 3.6.0
[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full remote code execution (RCE) and complete compromise of the web server
[Mitigation] Immediately upgrade the Page Builder CK extension to version 3.6.0 or higher
SmarterMail Unauthenticated Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2025-52691) Critical Security Advisory
[Affected Scope] SmarterMail mail server software
[Impact] Unauthenticated remote attackers can upload arbitrary files to any location on the mail server, potentially leading to full Remote Code Execution (RCE)
[Mitigation] Immediately apply the latest official security patches and restrict external access to sensitive upload endpoints and admin interfaces
Juniper Networks Junos OS (SRX Series) J-Web Unauthenticated Arbitrary File Upload and Download Vulnerability (CVE-2023-36851) Analysis and Mitigation Guide
[Affected Scope] Juniper Networks Junos OS on SRX Series devices with the J-Web interface enabled in specific vulnerable versions
[Impact] Unauthenticated network-based attackers can send crafted requests to webauth_operation.php to upload or download arbitrary files, compromising file system integrity and potentially chaining to remote code execution (RCE)
[Mitigation] Immediately upgrade Junos OS to the recommended patched release, or disable the J-Web interface / restrict access to trusted IP addresses
Juniper Networks Junos OS EX Series J-Web Unauthenticated Arbitrary File Upload Vulnerability (CVE-2023-36847) Analysis and Mitigation Guide
[Affected Scope] Juniper Networks Junos OS on EX Series switches with J-Web interface enabled in specific versions
[Impact] Unauthenticated, network-based attackers can upload arbitrary files via J-Web by targeting 'installAppPackage.php', compromising file system integrity and potentially chaining with other flaws for Remote Code Execution (RCE)
[Mitigation] Upgrade Junos OS to the recommended patched releases, or immediately disable the J-Web service and restrict management access
Juniper Junos OS SRX Series J-Web Unauthenticated Arbitrary File Upload Vulnerability (CVE-2023-36846) Technical Advisory
[Affected Scope] Juniper Networks Junos OS SRX Series firewalls with the J-Web interface enabled
[Impact] Unauthenticated remote attackers can upload arbitrary files via crafted HTTP requests to the file system, compromising integrity and potentially chaining with other flaws to achieve Remote Code Execution (RCE)
[Mitigation] Apply the latest Junos OS security updates immediately, or disable the J-Web interface and restrict access to trusted management IP ranges
NUUO NVRmini2 Unauthenticated User Creation and Remote Code Execution (CVE-2022-23227)
[Affected Scope] NUUO NVRmini2 firmware versions up to and including 3.11.
[Impact] Unauthenticated attackers can add arbitrary users and, when chained with CVE-2011-5325, overwrite files under the web root to execute arbitrary code as root.
[Mitigation] Immediately restrict external access to the device, apply the latest firmware updates, or implement strict access control lists.