CVE-2026-73328
High · 7.2CVSS
7.2
EPSS
0.7%
Published
Nov 3, 2026
CISA due date
—
The record
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121733 Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows… CWE-434
- CVE-2026-76124 The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all… CWE-434
- CVE-2026-120534 The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited… CWE-434
- CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom… CWE-434
- CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in… CWE-434
- CVE-2026-76010 The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is… CWE-434
- CVE-2026-118235 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications… CWE-434
- CVE-2026-116512 The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time… CWE-434