CVE-2025-28010

A cross-site scripting XSS vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image...

CVE-2024-13805

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-13805

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-13805

CVE-2024-13805 concerns the Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin for WordPress. It is reported as vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to and including 5.2.14 due to insufficient input sanitization and out...

CVE-2024-13805 Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-13805 Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-13805: Improper Neutralization of Input During Web Page Generation

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

PT-2025-10078

Name of the Vulnerable Software and Affected Versions The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin versions up to, and including, 5.2.14 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

WordPress Advanced File Manager plugin <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Duc Manh in WordPress Plugin Advanced File Manager versions = 5.2.14...

CVE-2025-25361

An arbitrary file upload vulnerability exists in PublicCMS version 4.0.202406 within the /cms/CmsWebFileAdminController.java component. Attackers can exploit this flaw by uploading crafted SVG or XML files , leading to the execution of arbitrary code . To mitigate this risk, it is recommended to ...

CVE-2025-25361

An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file...

CVE-2025-25361: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file...

CVE-2025-25361

An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file...

Linux Distros Unpatched Vulnerability : CVE-2023-50262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One o...

Linux Distros Unpatched Vulnerability : CVE-2021-45930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath...

Linux Distros Unpatched Vulnerability : CVE-2022-1231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Dependin...

USN-7318-1 spip vulnerabilities

It was discovered that svg-sanitizer, vendored in SPIP, did not properly sanitize SVG/XML content. An attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 24.10. CVE-2022-23638 It was discovered that SPIP did not properly sanitize certain inputs....

Linux Distros Unpatched Vulnerability : CVE-2017-5465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read while processing SVG content in ConvolvePixel. This results in a crash and also allows for otherwise inaccessible memory being copied into...

Linux Distros Unpatched Vulnerability : CVE-2014-1745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of...

Cross-site Scripting (XSS)

leantime/leantime is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper handling of SVG uploads which allows an attacker to inject malicious scripts and potentially redirect users to malicious websites by uploading specially crafted SVG files...