{"vulnerability": "CVE-2026-49849", "sightings": [{"uuid": "aa07d1b7-6ad1-4f02-9248-de93a9240575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmui26nmb2m", "content": "\ud83d\udd34 CVE-2026-49849 - Critical (9.1)\n\nxShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in x...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49849/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T23:00:58.987892Z"}, {"uuid": "d5388abf-a9f8-4b78-9897-e7c51110c690", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/br5ilubnsqhf7", "content": "CVE-2026-49849 - xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution\nCVE ID : CVE-2026-49849\n \n Published : Aug. 21, 2026, 10:16 p.m. | 17\u00a0minutes ago\n \n Description : xShop is an open-source shop developed in Laravel. An ...", "creation_timestamp": "2026-08-21T23:58:42.774250Z"}, {"uuid": "c1dfb0ee-0d7c-46bf-a16d-31bbf5ed3365", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtoflysfli25", "content": "CVE-2026-49849\nIn xShop version 3.0.3, an admin user can upload any type of file, including executable scripts, through the file attachment feature. A malicious file could be used to take control of the server and compromise\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T13:40:04.531140Z"}, {"uuid": "5b055040-752e-44c3-9c6b-7de4dc7ae112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49849", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtmxsrnra62x", "content": "4xmen xShop <3.0.4 has a CRITICAL vuln (CVE-2026-49849): admins can upload malicious files, enabling remote code execution. Upgrade to 3.0.4+ now. https://radar.offseq.com/threat/cve-2026-49849-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-4xmen-xshop-bbb8f71dbe4a15a6 #OffSeq #CVE202...", "creation_timestamp": "2026-08-22T00:00:40.173539Z"}, {"uuid": "f09d0e05-97f7-40ff-a20e-838e13802761", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49849", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117136217697075693", "content": "CVE-2026-49849 (CRITICAL): 4xmen xShop <3.0.4 lets authenticated admins upload dangerous files, leading to remote code execution \ud83d\udee1\ufe0f. Patch to 3.0.4 now. https://radar.offseq.com/threat/cve-2026-49849-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-4xmen-xshop-bbb8f71dbe4a15a6 #OffSeq #CVE202649849 #remotecodeexecution #infosec", "creation_timestamp": "2026-08-22T00:00:38.154000Z"}, {"uuid": "f6245e5e-f8a7-47a3-9d82-9ae428e4adec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtmy7gnomw2b", "content": "\ud83d\udea8 CVE-2026-49849 \u2014 CVSS 9.1 CRITICAL\n\nxShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop versi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-49849\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-22T00:07:44.486063Z"}, {"uuid": "d60395fd-e10b-4513-9985-79e279debd8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49849", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmyviypir23", "content": "CVE-2026-49849 - xshop\nThe online store software xShop version 3.0.3 lets a logged\u2011in administrator upload files without checking their type. An attacker could place a specially crafted script and run it on the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#xshop #4xmen #CVE #infosec", "creation_timestamp": "2026-08-22T00:20:04.865043Z"}]}