CVE-2025-60448

CVE-2025-60448 affects Emlog Pro 2.5.19; stored XSS via SVG uploads in /admin/media.php due to insufficient validation. Exploitation could occur when malicious SVGs are viewed. Affected component is the SVG upload handler; no fix version is stated in the sources. PT Security notes no information ...

CVE-2025-60450

MetInfo CMS 8.0 is affected by a stored XSS in file upload handling. The vulnerability arises from insufficient validation and sanitization of SVG uploads in app\system\include\module\editor\Uploader.class.php, allowing an attacker to upload SVG files containing JavaScript that executes when view...

PT-2025-40526

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.19 Description A stored Cross-Site Scripting XSS issue exists due to inadequate validation of SVG file uploads within the /admin/media.php component. This allows attackers to upload malicious SVG files containing JavaScri...

XunRuiCMS 安全漏洞

XunRuiCMS XunRuiCMS is a content management system for XunRuiCMS individual developers. A security vulnerability exists in XunRuiCMS version 4.7.1, which stems from insufficient validation of SVG file uploads and could lead to a stored cross-site scripting attack...

CVE-2025-60445

A stored Cross-Site Scripting XSS vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SVG file uploads in the dayrui/Fcms/Library/Upload.php component, allowing attackers to inject malicious JavaScript code that executes when th...

MetInfo CMS 安全漏洞

MetInfo CMS is a content management system from China's Mito MetInfo. A security vulnerability exists in MetInfo CMS version 8.0, which stems from insufficient validation and cleanup of SVG file uploads and could lead to a stored cross-site scripting attack...

PT-2025-40523

Name of the Vulnerable Software and Affected Versions MetInfo CMS version 8.0 Description A stored Cross-Site Scripting XSS issue exists in the image management module of the software. The vulnerability is located in the appsystemimgadminimg admin.class.php component. Attackers can upload malicio...

PT-2025-40522

Name of the Vulnerable Software and Affected Versions MetInfo CMS version 8.0 Description A stored Cross-Site Scripting XSS issue exists in MetInfo CMS. The vulnerability is located in the column management module, specifically within the appsystemcolumnadminindex.class.php component. Attackers c...

CVE-2025-60453

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files...

PT-2025-40520

Name of the Vulnerable Software and Affected Versions MetInfo CMS version 8.0 Description A stored Cross-Site Scripting XSS flaw exists because of inadequate validation and sanitization of SVG file uploads. The issue is located in the appsystemincludemoduleuploadify.class.php component within the...

PT-2025-40519

Name of the Vulnerable Software and Affected Versions MetInfo CMS version 8.0 Description A stored Cross-Site Scripting XSS flaw exists due to inadequate validation and sanitization of SVG file uploads within the appsystemincludemoduleeditorUploader.class.php component. This allows attackers to...

CVE-2025-60454

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\imgadmin.class.php component. The vulnerability allows attackers to upload malicious SVG files containi...

PT-2025-40497

Name of the Vulnerable Software and Affected Versions AP Background plugin for WordPress versions 3.8.1 through 3.8.2 Description The AP Background plugin for WordPress is susceptible to arbitrary file uploads because of missing authorization and inadequate file validation within the...

CVE-2025-59835

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the...

CVE-2025-59835 LangBot has a cross-directory file upload vulnerability, which could lead to system takeover

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the...

CVE-2025-59835 LangBot has a cross-directory file upload vulnerability, which could lead to system takeover

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the...

CVE-2025-59835

LangBot has a cross-directory file upload vulnerability affecting versions 4.1.0 through 4.3.4 (inclusive). The /api/v1/files/documents endpoint allows arbitrary file uploads because the server does not strictly constrain the storage directory, enabling dangerous files to be placed in system dire...

CVE-2025-11221

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affects ChangeFlow: from All versions through...

CVE-2025-11221 Remote Code Execution in GTONE ChangeFlow

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affects ChangeFlow: from All versions through...

GTONE ChangeFlow 安全漏洞

GTONE ChangeFlow is an application change management software from GTONE Korea. A security vulnerability exists in GTONE ChangeFlow v9.0.1.1 and prior versions, which stems from improper pathname restrictions and unrestricted uploads of dangerous file types, which could lead to improper path...