CVE-2026-5482

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. 

This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-548209.3Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.CVE-2026-548217.4Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.CVE-2026-548228.5Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.CVE-2026-548239.9Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.CVE-2026-548247.5Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.CVE-2026-548259.3Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.CVE-2026-548267.6Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.CVE-2026-548279.3Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.CVE-2026-548287.5Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.CVE-2026-548297.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album PlusCVE-2026-54839.9A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOACVE-2026-548307.5Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
CVE-2026-5482: Critical severity, CVSS 9.3 | Vulnix