CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Joomla iCagenda Extension Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2026-48939)
[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8
[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).
[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.
Joomla SP Page Builder Arbitrary File Upload and Remote Code Execution (RCE) Vulnerability (CVE-2026-48908)
[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla
[Impact] Unauthenticated attackers can upload and execute malicious PHP code, leading to complete takeover of the web server
[Mitigation] Immediately update to the latest patched version, apply WAF rules, and disable PHP execution in upload directories
Cleo Harmony, VLTrader, and LexiCom Unrestricted File Upload Remote Code Execution (RCE) Vulnerability (CVE-2024-50623) Urgent Security Advisory
[Affected Scope] Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21
[Impact] Unauthenticated remote attackers can upload and download arbitrary files, potentially leading to full Remote Code Execution (RCE) on the target server
[Mitigation] Immediately upgrade to version 5.8.0.21 or later, and restrict external access to the file transfer interfaces
Adobe ColdFusion Unrestricted File Upload Vulnerability (CVE-2018-15961) Remote Code Execution (RCE) Analysis and Mitigation Guide
[Affected Scope] Adobe ColdFusion 2018 (Release 2018.0.0.310739 and earlier), ColdFusion 2016 Update 6 and earlier, and ColdFusion 11 Update 14 and earlier
[Impact] Unauthenticated remote attackers can upload arbitrary executable files (such as .jsp) and execute them directly to achieve Remote Code Execution (RCE) with system privileges
[Mitigation] Immediately apply the official Adobe security patch (APSB18-33) and restrict execution permissions on publicly accessible upload directories
Progress Telerik UI for ASP.NET AJAX RadAsyncUpload Unrestricted File Upload and Remote Code Execution (RCE) Vulnerability (CVE-2017-11357)
[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2
[Impact] Unauthenticated remote attackers can exploit the vulnerable RadAsyncUpload component to upload arbitrary malicious files (such as ASPX webshells) and execute arbitrary code with web server privileges
[Mitigation] Immediately upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later, or apply workarounds by disabling RadAsyncUpload and hardening encryption keys
Telerik UI for ASP.NET AJAX RadAsyncUpload Weak Encryption Remote Code Execution (RCE) - CVE-2017-11317
[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions before R1 2017 and R2 before R2 2017 SP2
[Impact] Remote attackers can exploit weak encryption to perform unrestricted file uploads or execute arbitrary code on the target server
[Mitigation] Upgrade to the latest patched version of Telerik UI, or configure strong custom encryption keys in web.config