CVE-2025-2542

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform The vulnerabilities allow low-privileged users to abuse higher user privileges, which can lead to unauthorized actions and access to sensitive information. This can occur through phishing attacks and Cross-Site Request...

GPT Academic Resource Management Error Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a Resource Management Error vulnerability that stems from an excessive number of characters at the end of a multi-part boundary during a file upload that caus...

GPT Academic Cross-Site Request Forgery Vulnerability (CNVD-2025-22738)

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site request forgery vulnerability that stems from a WEB application that does not adequately verify that a request is from a trusted user. An attacke...

CVE-2025-2819

There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user...

CVE-2025-2819

CVE-2025-2819 affects Bizerba GT-SoftControl (HMI software). The vulnerability arises from insufficient validation during the file selection process, enabling an authenticated privileged user to upload arbitrary files and potentially overwrite existing ones. This can cause data integrity issues a...

CVE-2025-2819 Unrestricted Fileupload

There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user...

CVE-2025-2573

CVE-2025-2573: Stored XSS in Amazing service box Addons For WPBakery Page Builder (WordPress) via SVG uploads; affects all versions

CVE-2025-2576

CVE-2025-2576 pertains to the Ayyash Studio — The kick-start kit plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads in all versions up to 1.0.3, caused by insufficient input sanitization and output escaping. It requires an authenticated attacker wi...

PT-2025-12852

Name of the Vulnerable Software and Affected Versions The Amazing service box Addons For WPBakery Page Builder plugin for WordPress versions up to, and including, 2.0.0 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and...

PT-2025-12853

Name of the Vulnerable Software and Affected Versions The Ayyash Studio — The kick-start kit plugin for WordPress versions up to, and including, 1.0.3 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping...

CVE-2025-2576: Improper Neutralization of Input During Web Page Generation

The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

Bizerba GT-SoftControl 安全漏洞

Bizerba GT-SoftControl is an HMI software from Bizerba. A security vulnerability exists in Bizerba GT-SoftControl that stems from insufficient validation of the file selection process could result in unauthorized file uploads and overwrites...

CVE-2024-55028

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

CVE-2025-2542

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CVE-2025-2542: Improper Neutralization of Input During Web Page Generation

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

PT-2025-12788

Name of the Vulnerable Software and Affected Versions Your Simple SVG Support plugin for WordPress versions up to, and including, 1.0.1 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CVE-2025-2577

The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...

PT-2025-12670

Name of the Vulnerable Software and Affected Versions Kentico Xperience versions prior to 13.0.178 Description The Kentico Xperience application does not fully validate or filter files uploaded through the multiple-file upload functionality. This insufficient validation allows for stored Cross-Si...

CVE-2025-2577

The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...