PULSEUnderground Intel

EN VIVO15señales / 24h

FEED

ransomsarcoma reclama a Don Pickett & Associates · Professional Servicesransomscarlettgroup reclama a vinsolutions.com · US · Professional Servicesransomauditteam reclama a Ca***ka · ES · Not Foundransomrhysida reclama a Line2Line Coatings · Manufacturingransomfulcrumsec reclama a EMARKETER · US · Technologyransomn0n reclama a Horn of Africa Regional Environment Centre and Network · ET · Otherransomwallstreet reclama a Prism Medical Products · US · Healthcareransomn0n reclama a PROTEX Confection · TN · Manufacturingransomn0n reclama a SunTechnics Fabrisolar AG · CH · Energy & Utilitiesransomemperador reclama a B2Chat · Technologyransomqilin reclama a Coop Italia · IT · Retail & E-Commerceransomqilin reclama a SEPIVER · MX · Not Foundransomlockbit5 reclama a istanbultrading.com · TR · Retail & E-Commerceransomsilentransomgroup reclama a M... C... · Not Foundransomsarcoma reclama a Don Pickett & Associates · Professional Servicesransomscarlettgroup reclama a vinsolutions.com · US · Professional Servicesransomauditteam reclama a Ca***ka · ES · Not Foundransomrhysida reclama a Line2Line Coatings · Manufacturingransomfulcrumsec reclama a EMARKETER · US · Technologyransomn0n reclama a Horn of Africa Regional Environment Centre and Network · ET · Otherransomwallstreet reclama a Prism Medical Products · US · Healthcareransomn0n reclama a PROTEX Confection · TN · Manufacturingransomn0n reclama a SunTechnics Fabrisolar AG · CH · Energy & Utilitiesransomemperador reclama a B2Chat · Technologyransomqilin reclama a Coop Italia · IT · Retail & E-Commerceransomqilin reclama a SEPIVER · MX · Not Foundransomlockbit5 reclama a istanbultrading.com · TR · Retail & E-Commerceransomsilentransomgroup reclama a M... C... · Not Found

← Todos los CVEs

CVE Watch7 oct 2026

CVE-2026-92532

Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges c

CVSS

—

Sin CVSS

EPSS

0.3%

p22

KEV

—

Exploit Today

6

0-100

Publicado: 7 oct 2026 · Última mod.: 7 oct 2026 · CWE-434

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-10-082026-10-23

Descripción técnica

Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due to the lack of proper file extension validation, an attacker could upload a malicious ASPX file and subsequently execute it on the server. A successful exploit could allow arbitrary code execution with the privileges of the account used by the web service.

Referencias oficiales

www.incibe.eshttps://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bugtrackernet

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-102785—

——16Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.1d CVE-2026-1142627.3 ALT

——9A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.2d CVE-2026-1142597.3 ALT

——7A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.2d CVE-2026-1118349.9 CRÍ

——9Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.2d CVE-2026-11183210.0 CRÍ

——10Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.2d CVE-2026-1143985.4 MED

——2Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.1d