1542 matches found
Linux Distros Unpatched Vulnerability : CVE-2022-3870
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all version...
Stored XSS
Overview FormCMS is a FormCMS is an open-source Content Management System designed to simplify and accelerate web development workflows for CMS projects and general web applications. It streamlines data modeling, backend development, and frontend design, making them as intuitive as filling out a...
FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability
FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...
CVE-2025-56236
FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...
CVE-2025-48312
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Stored XSS.This issue affects WPAvatar: from n/a through = 1.9.4...
CVE-2025-56236
FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...
CVE-2025-56236
FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...
PT-2025-35097
Name of the Vulnerable Software and Affected Versions: FormCms version 0.5.5 Description: FormCms version 0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible v...
CVE-2025-56236
FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...
CVE-2025-56236
FormCms v0.5.5 contains a stored XSS vulnerability in the avatar upload endpoint (/api/profile/avatar). An authenticated attacker can upload a malicious .html file that is publicly accessible; when a privileged user opens the URL, the script executes in their browser context. Several sources (Ver...
FormCMS 安全漏洞
FormCMS is a page designer for formcms individual developers. A security vulnerability exists in FormCMS version 0.5.5, which stems from a stored cross-site script in the avatar upload feature that could lead to the execution of malicious script in a privileged user's browser environment...
CVE-2025-9296
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=updateavatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...
CVE-2025-9296
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=updateavatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...
CVE-2025-9296 Emlog Pro blogger.php unrestricted upload
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=updateavatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...
CVE-2025-9296 Emlog Pro blogger.php unrestricted upload
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=updateavatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...
CVE-2025-9296
CVE-2025-9296 affects Emlog Pro up to 2.5.18. The vulnerability resides in the /admin/blogger.php?action=update_avatar function where manipulating the image parameter enables unrestricted file uploads. This can be exploited remotely, and public disclosures exist. Connected sources consistently de...
CVE-2025-9296 Emlog Pro blogger.php unrestricted upload
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=updateavatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...
PT-2025-34203 · Emlog Pro · Emlog Pro
Name of the Vulnerable Software and Affected Versions: Emlog Pro versions through 2.5.18 Description: A security vulnerability has been detected in Emlog Pro. The issue affects an unknown function within the /admin/blogger.php?action=update avatar file. Manipulation of the image argument allows f...
Linux Distros Unpatched Vulnerability : CVE-2024-23790
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue...
