https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 06:01:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-23607 EUVD-2026-23607 https://cve.radiocsirt.org/vuln/euvd-2026-23607 https://cve.radiocsirt.org/vuln/fkie_cve-2021-24171 <p>The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a &#34;blocked&#34; extension within another &#34;blocked&#34; extension in the &#34;wcuf_file_name&#34; parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the &#34;wcuf_current_upload_session_id&#34; parameter.</p> <p>The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a &#34;blocked&#34; extension within another &#34;blocked&#34; extension in the &#34;wcuf_file_name&#34; parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the &#34;wcuf_current_upload_session_id&#34; parameter.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-24171 https://cve.radiocsirt.org/vuln/ghsa-73q3-2843-4j2x <p>The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a &#34;blocked&#34; extension within another &#34;blocked&#34; extension in the &#34;wcuf_file_name&#34; parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the &#34;wcuf_current_upload_session_id&#34; parameter.</p> <p>The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a &#34;blocked&#34; extension within another &#34;blocked&#34; extension in the &#34;wcuf_file_name&#34; parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the &#34;wcuf_current_upload_session_id&#34; parameter.</p> https://cve.radiocsirt.org/vuln/ghsa-73q3-2843-4j2x https://cve.radiocsirt.org/vuln/gsd-2021-24171 gsd-2021-24171 https://cve.radiocsirt.org/vuln/gsd-2021-24171