CVE-2026-108652

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SystemApiController updateAvatar handler. This security weakness allows any authenticated user to modify the avatars of other users, including administrators. A low-privileged attacker can exploit this by sendi...

EUVD-2026-96400

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

CVE-2026-108594

Mealie versions 3.26.0 through 3.28.0 are vulnerable to a server-side request forgery (SSRF) vulnerability in the OpenID Connect (OIDC) avatar fetch mechanism. The root cause is that the system ignores ports when allowlisting the identity provider hostname. Consequently, authenticated OIDC users ...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Мы требуем безопасного возвращения всех граждан, взятых в заложники террористической группировкой ХАМАС. Мы не успокоимся, пока каждый заложник не будет освобождён и не вернётся домой в безопасности. Вы можете помочь вернуть их...

Docmost 0.2.1-0.21.0 - Arbitrary File Read

Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL. id: CVE-2025-57231 info: name: Docmost 0.2.1-0.21.0 - Arbitrary File Read author: anirbala98 severity: high...

Label Studio - Cross-Site Scripting

Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. id: CVE-2023-47115 info: name: Label Studio - Cross-Site Scripting author: isaca...

CVE-2019-11447

CVE-2019-11447 - PoC Exploits CuteNews 2.1.2 via poor file upload checks used when uploading an avatar image leading to RCE. Установка Клонируйте репозиторий и установите зависимости. pip install -r requirements.txt Использование Для загрузки аватара вам потребуется учетная запись пользователя...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 — CVE-2019-11447 Доказательство концепции POC от CRFSlick, обнаружен AkkuS Была обнаружена проблема в CutePHP CuteNews 2.1.2. Злоумышленник может проникнуть на сервер через процесс загрузки аватара в области профиля, используя поле avatarfile для...

GHSA-4VH2-39RQ-RQ8J Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

CVE-2019-11447-EXP

CVE-2019-11447-EXP CuteNews Avatar 2.1.2 Уязвимость удаленного выполнения кода Перед запуском python-скрипта сначала выполните команду nc. Порт по умолчанию — 1234. Затем выполните exploit.py, следуйте подсказкам и введите необходимые данные...

CVE-2026-96518

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

CVE-2026-96337

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

CVE-2026-96518

The ProfilePress WordPress plugin (versions

CVE-2026-96337

The ProfilePress WordPress plugin (versions

EUVD-2026-95593

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

EUVD-2026-95594

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

CVE-2026-96518 WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

CVE-2026-96337 WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

PT-2026-108859

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...