EUVD-2025-28234

Malicious code in bioql PyPI...

EUVD-2021-28800

Malicious code in bioql PyPI...

EUVD-2023-2924

Malicious code in bioql PyPI...

CVE-2025-44593

Halo before version 2.20.13 is affected by a vulnerability where file type detection can be bypassed, allowing upload of malicious files such as .exe and .html. The upload of .html files can trigger stored XSS. This issue is fixed in 2.20.13. Affected product/versions are Halo prior to 2.20.13; r...

CVE-2025-56236

FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...

CVE-2025-56236

FormCms v0.5.5 contains a stored cross-site scripting XSS vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser...

Exploit for CVE-2025-54962

🔥 CVE-2025-54962 — Insecure File Upload in OpenPLC Runtime Web...

CVE-2023-23937

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid...

CVE-2021-41792

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to...

CVE-2022-27562

Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications...

CVE-2022-27562

CVE-2022-27562 is reported across multiple sources as a vulnerability in HCL Domino Volt caused by an unsafe default file-type filtering policy. This policy allows uploading of .html files and the execution of unsafe JavaScript in deployed applications, without publicly documented a fix in the co...

CVE-2024-12870

A stored cross-site scripting XSS vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch cec2080. The vulnerability allows an attacker to upload HTML/XML files that can host arbitrary JavaScript payloads. These files are served with the 'application/xml' conten...

CVE-2024-12374

A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...

CVE-2024-29891

ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in th...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

PT-2025-3093 · Grocy · Grocy

Name of the Vulnerable Software and Affected Versions: Grocy versions prior to 4.3.0 Description: The issue in the edit profile function of Grocy allows stored Cross Site Scripting XSS and resultant privilege escalation by uploading a crafted HTML or SVG file. Recommendations: For versions prior ...

Grocy 安全漏洞

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A security vulnerability exists in Grocy 4.3.0 and earlier versions, which stems from vulnerability to a stored cross-site scripting attack that can be achieved by uploading specially crafted HTML or SVG...

PT-2024-33114 · Unknown · Huly Platform

Name of the Vulnerable Software and Affected Versions: Huly Platform version 0.6.295 Description: The issue allows attackers to execute arbitrary code by uploading a crafted HTML file into the tracker comments page, potentially leading to code execution. Recommendations: For Huly Platform version...

Huly Platform 安全漏洞

Huly Platform is an all-in-one project management platform from Huly open source. A security vulnerability exists in Huly Platform version v0.6.295. An attacker can exploit the vulnerability to execute arbitrary code by uploading a specially crafted HTML file to a chat group...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the QuillJS WYSWYG editor in the admin panel, by modifying an HTML file before being uploaded to the server. Workaround Users who are not able to upgrade to the fixed version can: 1 Review the user...