{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abuddybossapp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:buddyboss:app:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-76124"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-76124\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["BuddyBoss App (\u003c= 3.2.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["BuddyBoss"],"content_html":"\u003cp\u003eThe BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 3.2.1 via the send_feedback function. The vulnerability arises from insufficient file type validation that relies on the client-supplied Content-Type header. Authenticated users with subscriber-level access and above can upload executable files. While files are intended to be deleted after transmission, a race condition during SMTP execution or a failure of the wp_mail() function can allow files to persist on the server.\u003c/p\u003e\n","date_modified":"2026-11-03T16:15:03Z","date_published":"2026-11-03T13:57:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-buddyboss-upload/","summary":"The BuddyBoss App WordPress plugin (all versions up to and including 3.2.1) is vulnerable to Arbitrary File Upload via the send_feedback function, which may lead to remote code execution.","title":"BuddyBoss App: Arbitrary File Upload in send_feedback function (CVE-2026-76124)","url":"https://feed.craftedsignal.io/briefs/2026-11-buddyboss-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:buddyboss:app:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}