shimosyan/phpuploader vulnerabilities

Latest shimosyan/phpuploader CVEs

Newest publication first

1. CVE-2026-56124 phpUploader < 2.0.2 Unauthenticated Database Exposure via index model

   Published 2026-06-29

   High·CVSS 8.7 EPSS 0.64%

   phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.