Malicious code in watch-for-free-avatar-the-way-of-water-edzdlzel (npm)

The package watch-for-free-avatar-the-way-of-water-edzdlzel was found to contain malicious code...

Malicious code in avatar-the-way-of-water-movie-streaming-edjezkd (npm)

The package avatar-the-way-of-water-movie-streaming-edjezkd was found to contain malicious code...

Malicious code in watch-avatar-the-way-of-water-2023-ergerfzef (npm)

The package watch-avatar-the-way-of-water-2023-ergerfzef was found to contain malicious code...

MAL-2025-46561 Malicious code in watch-avatar-the-way-of-water-2023-ergerfzef (npm)

The package watch-avatar-the-way-of-water-2023-ergerfzef was found to contain malicious code...

MAL-2025-46564 Malicious code in watch-for-free-avatar-the-way-of-water-edzdlzel (npm)

The package watch-for-free-avatar-the-way-of-water-edzdlzel was found to contain malicious code...

MAL-2025-46562 Malicious code in watch-avatar-the-way-of-water-now-dkedke (npm)

The package watch-avatar-the-way-of-water-now-dkedke was found to contain malicious code...

MAL-2025-43549 Malicious code in avatar-the-way-of-water-online-dkeldez (npm)

The package avatar-the-way-of-water-online-dkeldez was found to contain malicious code...

MAL-2025-43547 Malicious code in avatar-the-way-of-water-free-streaming-djzdk (npm)

The package avatar-the-way-of-water-free-streaming-djzdk was found to contain malicious code...

MAL-2025-43548 Malicious code in avatar-the-way-of-water-movie-streaming-edjezkd (npm)

The package avatar-the-way-of-water-movie-streaming-edjezkd was found to contain malicious code...

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

CVE-2024-49722

In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-CGRG-86M5-XM4W Memos Vulnerable to Stored Cross-Site Scripting

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extractImageInfo function for user avatars. An attacker can execute arbitrary scripts in the context of another user by uploading malicious files that are served without proper content type validation...

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

CVE-2025-56761

The CVE-2025-56761 entry concerns Memos 0.22 with a Stored XSS vulnerability via the upload attachment and user avatar features. The issue arises because content types of uploaded data are not verified and are served back unaltered, enabling an authenticated attacker to trigger stored XSS when vi...

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

CVE-2024-49722

In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-49722

In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

T-INNOVA Deporsite 安全漏洞

T-INNOVA Deporsite is an application from T-INNOVA, Inc. A security vulnerability exists in T-INNOVA Deporsite that stems from a lack of authorization and could lead to the modification of other users' avatars via POST requests and the IdPersona and Foto parameters...

CVE-2025-56236

FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...