CVE-2026-56124
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Jun 29, 2026
CISA due date
—
The record
phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
- CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
- CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
- CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359
- CVE-2026-48048 XWiki Platform is a generic wiki platform. CWE-359
- CVE-2026-24078 Information Disclosure when IPSec negotiation fails or is not established properly during… CWE-359
- CVE-2026-55496 Cloudreve is a self-hosted file management and sharing system. CWE-359
- CVE-2026-50657 Exposure of private personal information to an unauthorized actor in Microsoft Defender… CWE-359