CVE-2026-110468

Vendor

Fundacja Widzialni

Product

WidzialniCMS

CVSS v4.0

10.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-434

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 38
   CVE NVD 2h ago

   WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint.

   WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an…

   CVSS 10.0 Fix available CVE-2026-110468 Fundacja Widzialni
2. 30
   Advisory CERT Polska 5h ago

   Vulnerabilities in WidzialniCMS software

   CERT Polska coordinated disclosure of 4 vulnerabilities (CVE-2026-110468, CVE-2026-110469, CVE-2026-112204 and CVE-2026-112205) found in WidzialniCMS software.

   CVE-2026-110468CVE-2026-110469CVE-2026-112204+1 more