{"metadata": {"vulnerability": "CVE-2026-73328", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-11T21:47:14.059Z", "date_only": false, "value": "2026-08-11T21:47:14.059Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73328", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73328", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T15:17:18.488Z", "date_only": false, "value": "2026-11-03T15:17:18.488Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73328", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T15:17:18.488Z", "date_only": false, "value": "2026-11-03T15:17:18.488Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73328", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T15:42:44.757Z", "date_only": false, "value": "2026-11-03T15:42:44.757918Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117553270888081614", "record": "CVE-2026-73328", "field": "creation_timestamp", "uuid": "c2ba14e9-bbdf-42bf-ab41-02540efcfd04", "content": "CVE-2026-73328 Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/ Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-73328https://github.com/Volmarg/personal-management-system/issues/167https://github.com/Volmarg/personal-management-systemhttps://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send#volmarg #personal-management-system#CVE_2026_73328#bot", "url": "https://infosec.exchange/users/cve/statuses/117553270888081614"}, {"timestamp": "2026-11-03T16:17:36Z", "date_only": false, "value": "2026-11-03T16:17:36Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M4HJ-G435-QJ36", "record": "GHSA-M4HJ-G435-QJ36", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T16:17:36.340Z", "date_only": false, "value": "2026-11-03T16:17:36.340", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73328", "record": "FKIE_CVE-2026-73328", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T17:25:22.914Z", "date_only": false, "value": "2026-11-03T17:25:22.914702Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hok3vk2mpvkak", "record": "CVE-2026-73328", "field": "creation_timestamp", "uuid": "45c9db03-edee-44a9-9843-50bbf5f4d9d2", "content": "CVE-2026-73328 - Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/\nCVE ID : CVE-2026-73328\n \n Published : Nov. 3, 2026, 4:17 p.m. | 46\u00a0minutes ago\n \n Description : Volmarg Personal Management System through 2.1.0 contains an unrest...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/hok3vk2mpvkak"}, {"timestamp": "2026-11-03T17:48:23.881Z", "date_only": false, "value": "2026-11-03T17:48:23.881999Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73328", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-03T17:48:23.881Z", "date_only": false, "value": "2026-11-03T17:48:23.881999Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73328", "record": "FKIE_CVE-2026-73328", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-03T18:27:35.213Z", "date_only": false, "value": "2026-11-03T18:27:35.213Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73328", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T18:27:35.213Z", "date_only": false, "value": "2026-11-03T18:27:35.213Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73328", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T18:31:07Z", "date_only": false, "value": "2026-11-03T18:31:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M4HJ-G435-QJ36", "record": "GHSA-M4HJ-G435-QJ36", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T18:31:07Z", "date_only": false, "value": "2026-11-03T18:31:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M4HJ-G435-QJ36", "record": "GHSA-M4HJ-G435-QJ36", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T19:18:10.587Z", "date_only": false, "value": "2026-11-03T19:18:10.587", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73328", "record": "FKIE_CVE-2026-73328", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-04T04:10:04.675Z", "date_only": false, "value": "2026-11-04T04:10:04.675589Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzhiattwwo2v", "record": "CVE-2026-73328", "field": "creation_timestamp", "uuid": "04af2977-aa40-4d98-ae5e-76a53b36ad24", "content": "CVE-2026-73328 - personal-management-system\nThe Volmarg Personal Management System (up to version 2.1.0) lets users who are signed in upload any file, including PHP scripts, to the web folder. If an attacker uploads\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#volmarg #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzhiattwwo2v"}], "metrics": {"as_of": "2026-11-11T20:02:18.818Z", "anchors": {"origin": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73328", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73328", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 849738.818345, "hours": 236.0385606513889, "days": 9.834940027141204, "min_seconds": 763338.818345, "max_seconds": 849738.818345, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73328", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T20:02:18.818Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}