CVE-2024-53617

LibrePhotos versions prior to commit 32237 (and before version 2024w47 ) are vulnerable to a Stored Cross-Site Scripting (XSS) and Insecure Direct Object Reference (IDOR) vulnerability in the file upload functionality. An attacker can exploit the IDOR to upload an HTML file on behalf of an admini...

CVE-2024-53617: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the admin user using IDOR in file upload...

GHSA-5R2G-59PX-3Q9W Stored XSS using two files in usememos/memos

A stored cross-site scripting XSS vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This...

CVE-2023-0109

A stored cross-site scripting XSS vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This...

CVE-2023-0109 Stored XSS in usememos/memos

A stored cross-site scripting XSS vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This...

CVE-2023-0109: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This...

CVE-2024-48450

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group...

CVE-2024-48448

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker comments page...

CVE-2024-48450

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group...

CVE-2024-48448

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker comments page...

CVE-2024-48448

An arbitrary file upload vulnerability exists in Huly Platform v0.6.295 . Attackers can exploit this flaw by uploading a crafted HTML file into the tracker comments page , which can lead to arbitrary code execution . To mitigate this risk, users should restrict access to the file upload feature i...

CVE-2024-48450

The Huly Platform (version v0.6.295 ) is affected by an arbitrary file upload vulnerability. An attacker can exploit this flaw by uploading a specially crafted HTML file into a chat group , which leads to the execution of arbitrary code . While a research link is provided, specific exploit code o...

CVE-2024-48448

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker comments page...

CVE-2024-48450

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group...

CVE-2024-48450: Server-Side Request Forgery (SSRF)

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group...

PT-2024-33116

Name of the Vulnerable Software and Affected Versions Huly Platform version 0.6.295 Description The issue allows attackers to execute arbitrary code by uploading a crafted HTML file into a chat group, potentially leading to code execution. Recommendations For Huly Platform version 0.6.295, consid...

CVE-2024-46482

An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .html or .svg file...

CVE-2024-10099 Stored XSS in comfyanonymous/comfyui

A stored cross-site scripting XSS vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the /api/upload/image endpoint. The payload is executed when the file is viewe...

CVE-2024-10099 Stored XSS in comfyanonymous/comfyui

A stored cross-site scripting XSS vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the /api/upload/image endpoint. The payload is executed when the file is viewe...

CVE-2024-10099

CVE-2024-10099 is a stored XSS in comfyanonymous/comfyui triggered by uploading an HTML image via /api/upload/image and executing when viewed through /view. Affected versions cited include 0.2.2 and possibly earlier; some sources also reference up to 0.3.39, indicating broader impact across multi...