Unrestricted Upload of File with Dangerous Type

Overview moonshine/moonshine is a Laravel administration panel Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type via the Files - Thumbnail parameter when creating/updating an Article. An attacker can run scripts within the context of the applicati...

Cross-site Scripting (XSS)

Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /image endpoint. An attacker can cause loading of unauthorized third-party images, including potentially malicious SVG files,...

CVE-2025-9145 Scada-LTS SVG File view_edit.shtm cross site scripting

A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file viewedit.shtm of the component SVG File Handler. Such manipulation of the argument backgroundImageMP leads to cross site scripting. The attack can be launched remotely. The...

CVE-2025-51489

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened...

CVE-2025-9145: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file viewedit.shtm of the component SVG File Handler. Such manipulation of the argument backgroundImageMP leads to cross site scripting. The attack can be launched remotely. The...

Scada-LTS code injection vulnerability

Scada-LTS is an open source, web-based, multi-platform solution from Scada-LTS Open Source. A code injection vulnerability exists in Scada-LTS version 2.7.8.1, which originates from a cross-site scripting attack due to misuse of the file viewedit.shtm parameter backgroundImageMP in the component...

CVE-2025-51489: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened...

CVE-2025-51489

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened...

MAL-2025-22003 Malicious code in grunt-vox-svg-prepper (npm)

The package grunt-vox-svg-prepper was found to contain malicious code...

Malicious code in svg-config-viewer (npm)

The package svg-config-viewer was found to contain malicious code...

Malicious code in svg-mixer-test (npm)

The package svg-mixer-test was found to contain malicious code...

MAL-2025-34254 Malicious code in svg-mixer-test (npm)

The package svg-mixer-test was found to contain malicious code...

MAL-2025-34255 Malicious code in svg-page-browser (npm)

The package svg-page-browser was found to contain malicious code...

MAL-2025-34256 Malicious code in svg-presentation (npm)

The package svg-presentation was found to contain malicious code...

Malicious code in grunt-vox-svg-prepper (npm)

The package grunt-vox-svg-prepper was found to contain malicious code...

Malicious code in svg-page-browser (npm)

The package svg-page-browser was found to contain malicious code...

Malicious code in svg-presentation (npm)

The package svg-presentation was found to contain malicious code...

MAL-2025-34253 Malicious code in svg-config-viewer (npm)

The package svg-config-viewer was found to contain malicious code...

SVG-sanitizer input validation error vulnerability

svg-sanitizer is a SVG format file cleaning tool by the individual developer Daryll Doyle. An input validation error vulnerability exists in versions of svg-sanitizer prior to 0.22.0, which stems from the cleanXlinkHrefs method searching only for lowercase attribute names, which could lead to...

CVE-2025-55006 Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content...