CVE-2026-111834

CriticalCVSS 9.9/10Last modified Oct 21, 2026

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Oct 21, 2026
Last modified
Oct 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1118356.5Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly ConfigurCVE-2026-1118364.3Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access CCVE-2026-1118376.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery conteCVE-2026-1118387.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehuCVE-2026-1118395.3Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting IncorCVE-2026-111846.3Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictionsCVE-2026-1118407.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat TurnkeCVE-2026-1118425.3Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access CCVE-2026-1118436.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows StCVE-2026-1118446.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.ThCVE-2026-1118455.3Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly CVE-2026-1118475.4Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorre