Toeverything AFFiNE code injection vulnerability

Toeverything AFFiNE is a knowledge management software from Toeverything open source. AFFiNE 0.24.1 and earlier versions suffer from a code injection vulnerability that stems from an unknown code flaw in the Avatar Upload Image Endpoint component, which could lead to a cross-site scripting attack...

PT-2025-42724

Name of the Vulnerable Software and Affected Versions toeverything AFFiNE versions prior to 0.24.1 Description A security issue exists in toeverything AFFiNE up to version 0.24.1 related to the Avatar Upload Image Endpoint. This can be exploited to perform cross site scripting. The attack can be...

CVE-2025-11945: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The...