Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by mjperpinosa
CVE-2026-10807 (GCVE-0-2026-10807)
Vulnerability from nvd – Published: 2026-06-04 12:30 – Updated: 2026-06-04 13:48
VLAI
Title
mjperpinosa stumasy change_profile_image.php unrestricted upload
Summary
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368255 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/368255/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10807 | third-party-advisory |
| https://vuldb.com/submit/831551 | third-party-advisory |
| https://github.com/mjperpinosa/stumasy/issues/3 | exploitissue-tracking |
| https://github.com/mjperpinosa/stumasy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mjperpinosa | stumasy |
Affected:
25d695901fbb586bf184b8ba73456d8e5311656c
Affected: 79c86fce86a09adc6edcbd6d56115fbff14ed538 Affected: 327d1b0f2915ba79d7ef8ebb74553e987609d9be cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10807",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:48:14.951725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:48:22.393Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*"
],
"product": "stumasy",
"vendor": "mjperpinosa",
"versions": [
{
"status": "affected",
"version": "25d695901fbb586bf184b8ba73456d8e5311656c"
},
{
"status": "affected",
"version": "79c86fce86a09adc6edcbd6d56115fbff14ed538"
},
{
"status": "affected",
"version": "327d1b0f2915ba79d7ef8ebb74553e987609d9be"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "j1nk1ng (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T12:30:12.057Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368255 | mjperpinosa stumasy change_profile_image.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/368255"
},
{
"name": "VDB-368255 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368255/cti"
},
{
"name": "CVE-2026-10807 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10807"
},
{
"name": "Submit #831551 | mjperpinosa stumasy 1.0 RCE vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/831551"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/mjperpinosa/stumasy/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/mjperpinosa/stumasy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-04T07:19:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "mjperpinosa stumasy change_profile_image.php unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10807",
"datePublished": "2026-06-04T12:30:12.057Z",
"dateReserved": "2026-06-04T05:14:46.616Z",
"dateUpdated": "2026-06-04T13:48:22.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10806 (GCVE-0-2026-10806)
Vulnerability from nvd – Published: 2026-06-04 12:15 – Updated: 2026-06-04 15:06
VLAI
Title
mjperpinosa stumasy add_post.php unrestricted upload
Summary
A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368254 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/368254/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10806 | third-party-advisory |
| https://vuldb.com/submit/831510 | third-party-advisory |
| https://github.com/mjperpinosa/stumasy/issues/1 | exploitissue-tracking |
| https://github.com/mjperpinosa/stumasy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mjperpinosa | stumasy |
Affected:
25d695901fbb586bf184b8ba73456d8e5311656c
Affected: 79c86fce86a09adc6edcbd6d56115fbff14ed538 Affected: 327d1b0f2915ba79d7ef8ebb74553e987609d9be cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10806",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T15:03:00.695671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T15:06:43.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*"
],
"product": "stumasy",
"vendor": "mjperpinosa",
"versions": [
{
"status": "affected",
"version": "25d695901fbb586bf184b8ba73456d8e5311656c"
},
{
"status": "affected",
"version": "79c86fce86a09adc6edcbd6d56115fbff14ed538"
},
{
"status": "affected",
"version": "327d1b0f2915ba79d7ef8ebb74553e987609d9be"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cnluminous (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T12:15:10.177Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368254 | mjperpinosa stumasy add_post.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/368254"
},
{
"name": "VDB-368254 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368254/cti"
},
{
"name": "CVE-2026-10806 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10806"
},
{
"name": "Submit #831510 | mjperpinosa stumasy 1.0 RCE vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/831510"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/mjperpinosa/stumasy/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/mjperpinosa/stumasy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-04T07:19:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "mjperpinosa stumasy add_post.php unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10806",
"datePublished": "2026-06-04T12:15:10.177Z",
"dateReserved": "2026-06-04T05:14:43.960Z",
"dateUpdated": "2026-06-04T15:06:43.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10807 (GCVE-0-2026-10807)
Vulnerability from cvelistv5 – Published: 2026-06-04 12:30 – Updated: 2026-06-04 13:48
VLAI
Title
mjperpinosa stumasy change_profile_image.php unrestricted upload
Summary
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368255 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/368255/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10807 | third-party-advisory |
| https://vuldb.com/submit/831551 | third-party-advisory |
| https://github.com/mjperpinosa/stumasy/issues/3 | exploitissue-tracking |
| https://github.com/mjperpinosa/stumasy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mjperpinosa | stumasy |
Affected:
25d695901fbb586bf184b8ba73456d8e5311656c
Affected: 79c86fce86a09adc6edcbd6d56115fbff14ed538 Affected: 327d1b0f2915ba79d7ef8ebb74553e987609d9be cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10807",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:48:14.951725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:48:22.393Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*"
],
"product": "stumasy",
"vendor": "mjperpinosa",
"versions": [
{
"status": "affected",
"version": "25d695901fbb586bf184b8ba73456d8e5311656c"
},
{
"status": "affected",
"version": "79c86fce86a09adc6edcbd6d56115fbff14ed538"
},
{
"status": "affected",
"version": "327d1b0f2915ba79d7ef8ebb74553e987609d9be"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "j1nk1ng (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T12:30:12.057Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368255 | mjperpinosa stumasy change_profile_image.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/368255"
},
{
"name": "VDB-368255 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368255/cti"
},
{
"name": "CVE-2026-10807 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10807"
},
{
"name": "Submit #831551 | mjperpinosa stumasy 1.0 RCE vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/831551"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/mjperpinosa/stumasy/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/mjperpinosa/stumasy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-04T07:19:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "mjperpinosa stumasy change_profile_image.php unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10807",
"datePublished": "2026-06-04T12:30:12.057Z",
"dateReserved": "2026-06-04T05:14:46.616Z",
"dateUpdated": "2026-06-04T13:48:22.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10806 (GCVE-0-2026-10806)
Vulnerability from cvelistv5 – Published: 2026-06-04 12:15 – Updated: 2026-06-04 15:06
VLAI
Title
mjperpinosa stumasy add_post.php unrestricted upload
Summary
A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368254 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/368254/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10806 | third-party-advisory |
| https://vuldb.com/submit/831510 | third-party-advisory |
| https://github.com/mjperpinosa/stumasy/issues/1 | exploitissue-tracking |
| https://github.com/mjperpinosa/stumasy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mjperpinosa | stumasy |
Affected:
25d695901fbb586bf184b8ba73456d8e5311656c
Affected: 79c86fce86a09adc6edcbd6d56115fbff14ed538 Affected: 327d1b0f2915ba79d7ef8ebb74553e987609d9be cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10806",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T15:03:00.695671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T15:06:43.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*"
],
"product": "stumasy",
"vendor": "mjperpinosa",
"versions": [
{
"status": "affected",
"version": "25d695901fbb586bf184b8ba73456d8e5311656c"
},
{
"status": "affected",
"version": "79c86fce86a09adc6edcbd6d56115fbff14ed538"
},
{
"status": "affected",
"version": "327d1b0f2915ba79d7ef8ebb74553e987609d9be"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cnluminous (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T12:15:10.177Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368254 | mjperpinosa stumasy add_post.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/368254"
},
{
"name": "VDB-368254 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368254/cti"
},
{
"name": "CVE-2026-10806 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10806"
},
{
"name": "Submit #831510 | mjperpinosa stumasy 1.0 RCE vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/831510"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/mjperpinosa/stumasy/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/mjperpinosa/stumasy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-04T07:19:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "mjperpinosa stumasy add_post.php unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10806",
"datePublished": "2026-06-04T12:15:10.177Z",
"dateReserved": "2026-06-04T05:14:43.960Z",
"dateUpdated": "2026-06-04T15:06:43.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}