CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
WebDyne Perl Framework Remote Code Execution Vulnerability due to Missing Regex Anchor (CVE-2026-78191)
[Affected Scope] Perl-based web applications utilizing WebDyne versions 2.031 through 3.021
[Impact] Remote attackers can bypass file upload restrictions using double extensions (e.g., .psp.pdf) to execute arbitrary Perl code on the server, leading to full system compromise
[Mitigation] Immediately upgrade the WebDyne framework to the patched version 3.022 or higher
Adobe Commerce (Magento) Unrestricted File Upload Vulnerability (CVE-2026-48356) - Critical RCE Advisory
[Affected Scope] All versions of Adobe Commerce and Magento Open Source prior to APSB26-73.
[Impact] Remote Code Execution (RCE) via malicious file upload, leading to full server compromise and potential data exfiltration.
[Mitigation] Apply official Adobe security patches (APSB26-73) immediately and restrict execution permissions in upload directories.
dotCMS ContentResource API Directory Traversal Remote Code Execution Vulnerability (CVE-2022-26352) Technical Analysis and Hardening Guide
[Affected Scope] dotCMS versions 3.0 through 22.02
[Impact] Unauthenticated attackers can upload malicious JSP files via directory traversal when anonymous content creation is enabled, leading to full Remote Code Execution (RCE)
[Mitigation] Immediately upgrade to patched dotCMS versions (22.03 or higher) and disable anonymous content creation APIs if not required
WSO2 Unrestricted File Upload and Remote Code Execution Vulnerability Analysis (CVE-2022-29464)
[Affected Scope] WSO2 API Manager (2.2.0 to 4.0.0), Identity Server (5.2.0 to 5.11.0), Enterprise Integrator (6.2.0 to 6.6.0), and other major WSO2 products
[Impact] Unauthenticated attackers can upload and execute arbitrary JSP files via a crafted HTTP request, leading to complete system compromise
[Mitigation] Apply official WSO2 security patches immediately, restrict external access to the '/fileupload' endpoint, and disable execution permissions in web root subdirectories
VMware vCenter Server Analytics Service Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2021-22005) Security Advisory
[Affected Scope] VMware vCenter Server versions 6.7 and 7.0 running the Analytics (CEIP) service
[Impact] Unauthenticated attackers with network access to port 443/TCP can upload arbitrary files and execute remote code with system privileges
[Mitigation] Apply official vendor patches immediately, or implement the temporary workaround to disable the vulnerable Analytics endpoint
ONLYOFFICE Document Server Remote Code Execution (RCE) Advisory (CVE-2021-3199)
[Affected Scope] ONLYOFFICE Document Server versions prior to 5.6.3 (when JWT is enabled)
[Impact] Attackers can achieve Remote Code Execution (RCE) by uploading malicious files to arbitrary directories.
[Mitigation] Immediately update ONLYOFFICE Document Server to version 5.6.3 or later.
WordPress File Manager Plugin Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2020-25213)
[Affected Scope] WordPress File Manager (wp-file-manager) plugin versions 6.0 through 6.8
[Impact] Unauthenticated remote attackers can upload and execute arbitrary PHP code, leading to complete compromise of the underlying web server
[Mitigation] Immediately update the File Manager plugin to version 6.9 or higher, or completely deactivate and remove the plugin if not required
Apache ActiveMQ Fileserver Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2016-3088)
[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled
[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise
[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration