CVE-2022-50957

Drupal avataruploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the file parameter. Attackers can craft URLs with script payloads in the file parameter of avataruploader.pages.inc to...

PT-2014-8855

Name of the Vulnerable Software and Affected Versions Drupal Avatar Uploader module versions 6.x-1.x before 6.x-1.2 Drupal Avatar Uploader module versions 7.x-1.x before 7.x-1.0-beta6 Description The issue allows remote authenticated users to read arbitrary files via a .. dot dot in the path of a...