CVE-2026-10806

A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-284
• CWE-434

• https://github.com/mjperpinosa/stumasy/
• https://github.com/mjperpinosa/stumasy/issues/1
• https://vuldb.com/cve/CVE-2026-10806
• https://vuldb.com/submit/831510
• https://vuldb.com/vuln/368254
• https://vuldb.com/vuln/368254/cti

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10800A weakness has been identified in PaddlePaddle FastDeploy up…3.6
• CVE-2026-10801A security vulnerability has been detected in modelscope ms-…3.6
• CVE-2026-10802A vulnerability was detected in keystonejs keystone up to 20…4.3
• CVE-2026-10803A flaw has been found in MLflow up to 3.10.0. This issue aff…3.6
• CVE-2026-10804A vulnerability has been found in Streamlit up to 1.53.0. Im…4.7
• CVE-2026-10805A flaw was found in NetworkManager. This local privilege esc…6.7
• CVE-2026-10807A vulnerability was determined in mjperpinosa stumasy. The i…6.3
• CVE-2026-10808A vulnerability was identified in itsourcecode Fees Manageme…6.3
• CVE-2026-10809A security flaw has been discovered in itsourcecode Fees Man…6.3
• CVE-2026-1081The Set Bulk Post Categories plugin for WordPress is vulnera…4.3
• CVE-2026-10810A weakness has been identified in itsourcecode Fees Manageme…4.3
• CVE-2026-10811A security vulnerability has been detected in itsourcecode F…6.3