CVE-2024-53615

CVE-2024-53615 A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file. Prerequisites: ffmpeg in PATH config.php: 'allowupload' = true exec must be...

LG Supersign EZ CMS - Remote Code Execution

LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsrserver/device/getThumbnail. id: CVE-2018-17173 info: name: LG Supersign EZ CMS - Remote Code Execution author: pussycat0x severity: critical description: | LG SuperSign CMS allows remote attackers...

LG LED Assistant - Thumbnail Path Traversal File Upload

A path traversal vulnerability exists in the endpoint handler for /api/thumbnail in Common.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. id: CVE-2024-2863 info: name: LG LED Assistant - Thumbnail...

CVE-2026-110650

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

EUVD-2026-101278

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110650

The thumbnail Python package (versions through 1.5 ) is vulnerable to an OS command injection in the generate_thumbnail() function. The root cause is the failure to neutralize shell metacharacters in file paths, allowing an attacker to inject commands into os.system() calls when the package execu...

CVE-2026-110225 Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata...

CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: ConcreteCMS v9.2.1 is affected by Arbitrary File Upload vulnerability which allows Cross-Site Scriting XSS stored. Attack Vectors: A vulnerability in "Thumbnail" file upload sanitation allows you to upload a PDF / SVG /HTML file with hidd...

CVE-2025-32140

🚨 CVE-2025-32140 – WP Remote Thumbnail Exploit Arbitrary File Upload 📝 Description CVE-2025-32140 is a critical vulnerability in the WP Remote Thumbnail plugin for WordPress. It enables authenticated attackers with contributor or higher permissions to upload arbitrary files , such as web shells ,...

CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin versions before 2.2.1 is vulnerable to an authorization bypass due to a lack of per-object authorization checks. Specifically, the pfg_delete_video_thumbnail function fails to verify ownership, allowing users with the Contributor role and above to per...

CVE-2026-26833

CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...

CVE-2026-106061 Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file

A flaw was found in GIMP’s X cursor XMC thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subseque...

CVE-2026-106061

A flaw was found in GIMP’s X cursor XMC thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subseque...

CVE-2026-106061

A flaw was found in GIMP\u2019s X cursor XMC thumbnail loader. When...

CVE-2026-105764

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

EUVD-2026-92868

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764

In versions prior to 3.2.4 , Immich (a self-hosted photo and video management solution) is vulnerable to Remote Code Execution (RCE) . An authenticated non-admin user can upload crafted SVG files that bypass the libvips native loader and fall through to ImageMagick coders. By using attacker-contr...

Astra Linux – Vulnerability in openimageio

A heap-based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially crafted PSD file can lead to arbitrary code execution. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in libraw

LibRaw before 0.20-RC1 lacks a check for the thumbnail size range. This affects decoders/unpackthumb.cpp, postprocessing/memimage.cpp, and utils/thumbutils.cpp. For example, mallocsizeoflibrawprocessedimaget+T.tlength is used without validating T.tlength...