CVE-2025-34282 ThingsBoard < v4.2.1 SVG Image SSRF

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...

CVE-2025-34281

ThingsBoard vulnerability CVE-2025-34281 affects pre-4.2.1 releases. An authenticated user can upload malicious SVGs via the Image Gallery, enabling Stored XSS when the image is loaded by a browser (e.g., through public API access or iframe embedding during widget creation/deployment on dashboard...

CVE-2025-10700

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

MAL-2025-48447 Malicious code in deere-ui-svg-to-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 229dbd48954859b2ccfde1edb98abf497a0d03d9e6d0c82d863cc2aea74ac1f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deere-ui-svg-to-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 229dbd48954859b2ccfde1edb98abf497a0d03d9e6d0c82d863cc2aea74ac1f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-34853

Malicious code in deere-ui-svg-to-react npm...

CVE-2025-34281: Improper Neutralization of Input During Web Page Generation

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

PT-2025-42642

Name of the Vulnerable Software and Affected Versions ThingsBoard versions prior to 4.2.1 Description The software contains a server-side request forgery SSRF issue within the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file referencing a remote URL. If the...

ThingsBoard 安全漏洞

ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard versions prior to 4.2.1, which stems from insufficient cleanup of uploaded SVG files and improper validation of content type...

CVE-2025-34282: Server-Side Request Forgery (SSRF)

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...

bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)

Summary In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. Details The underlying probl...

Arbitrary Code Injection

Overview @cocalc/frontend is a CoCalc: Collaborative Calculation Affected versions of this package are vulnerable to Arbitrary Code Injection via uploading a crafted SVG file. An attacker can execute arbitrary code by uploading a specially crafted SVG file. Remediation A fix was pushed into the...

Arbitrary Code Injection

Overview @cocalc/hub is a CoCalc: Backend webserver component Affected versions of this package are vulnerable to Arbitrary Code Injection via uploading a crafted SVG file. An attacker can execute arbitrary code by uploading a specially crafted SVG file. Remediation A fix was pushed into the mast...

CVE-2025-62418

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

CVE-2025-62418 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

CVE-2025-10700

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

EUVD-2025-34704

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

CVE-2025-10700

CVE-2025-10700 concerns the WordPress plugin Ally – Web Accessibility & Usability (versions up to 3.8.0). The issue is Cross-Site Request Forgery caused by missing/incorrect nonce validation in enable_unfiltered_files_upload, allowing unauthenticated attackers to trick an admin into enabling unfi...

CoCalc 安全漏洞

CoCalc is a web-based software from CoCalc, Inc. that enables collaboration in research, teaching, and scientific publishing. A security vulnerability exists in versions prior to CoCalc 0d2ff58 that stems from inadequate validation when uploading specially crafted SVG files, which could lead to t...

CVE-2025-61514: Improper Neutralization of Special Elements used in a Command

An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG file...