CVE-2026-10806

MediumCVSS 6.3/10Last modified Jul 22, 2026

Description

A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1080626.9Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whCVE-2026-1080635.5A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongsiCVE-2026-1080646.5The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL cCVE-2026-1080659.8SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — misCVE-2026-1080662.7The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authenticatiCVE-2026-1080695.3The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before aCVE-2026-108076.3A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiCVE-2026-1080708.7A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to aCVE-2026-1080718.7Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticaCVE-2026-1080725.4Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared thCVE-2026-1080735.3The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single uCVE-2026-108086.3A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown function of the file /manage_student.php.