14766 matches found
CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...
CVE-2024-51991
October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...
CVE-2024-51991 October CMS Allows Unprotected SVG Rename in Media Manager
October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...
CVE-2024-51991 October CMS Allows Unprotected SVG Rename in Media Manager
October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...
CVE-2024-51991 October CMS Allows Unprotected SVG Rename in Media Manager
October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...
CVE-2024-51991
October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the "media.cleanvectors" configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...
CVE-2024-51991
CVE-2024-51991 concerns October CMS (versions prior to 3.7.5) where an authenticated administrator with a site using the media.clean_vectors SVG sanitization can bypass protection by uploading a file with a permitted extension (e.g., .jpg/.png) and later renaming it to .svg. The issue is mitigate...
Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...
GHSA-MWFG-948F-2CC5 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...
October CMS Allows Unprotected SVG Rename in Media Manager
Impact This advisory affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with ...
GHSA-96HH-8HX5-CPW7 October CMS Allows Unprotected SVG Rename in Media Manager
Impact This advisory affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with ...
CVE-2025-46335: Improper Neutralization of Input During Web Page Generation
Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...
CVE-2024-51991: Unrestricted Upload of File with Dangerous Type
October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...
PT-2025-19768
Name of the Vulnerable Software and Affected Versions Mobile Security Framework MobSF versions up to and including 4.3.2 Description A Stored Cross-Site Scripting XSS issue has been identified in MobSF. The issue arises from improper sanitization of user-supplied SVG files during the Android APK...
PT-2025-19734
Name of the Vulnerable Software and Affected Versions October CMS versions prior to 3.7.5 Description A vulnerability in October CMS affects authenticated administrators with sites that have the media.clean vectors configuration enabled, allowing an authenticated user to bypass the protection of...
Mobile Security Framework (MobSF) Cross-Site Script Vulnerabilities
Mobile Security Framework MobSF is Mobile Security Framework open source an automated all-in-one mobile application . Used for penetration testing, malware analysis and security assessments, it is capable of performing both static and dynamic analysis. A cross-site scripting vulnerability exists ...
October code issues and vulnerabilities
October is a content management system CMS and web platform from October Open Source. A code issue vulnerability exists in versions prior to October 3.7.5 that stems from not properly cleaning SVG files, which could lead to bypassing protection...
CVE-2022-42450
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications...