1121 matches found
CVE-2026-24708
CVE-2026-24708 affects OpenStack Nova (Flat image backend), where an attacker could cause unsafe image resize by writing a malicious QCOW header to a root or ephemeral disk, triggering qemu-img without a format restriction. Affected: Nova releases before 30.2.2, 31 before 31.2.1, and 32 before 32...
PT-2026-20566
Dan Smith discovered that Nova incorrectly called qemu-img without a format restriction when resizing disks. An attacker could possibly use this issue to destroy data on the host system...
CVE-2020-37073
Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the userimage parameter. Attackers can upload a malicious PHP shell to the /img/ directory and execute system commands by accessing the uploaded file wi...
BIT-JOOMLA-2025-63082 Joomla! Core - [20260101] - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags...
The vulnerability of the qemu-img utility of the Ironic Python Agent, which enables unauthorized access to protected information between the Ironic system and the physical hardware.
The vulnerability of the qemu-img utility of the Ironic Python Agent IPA relates to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
CVE-2025-8072
CVE-2025-8072 affects the WordPress plugin Target Video Easy Publish (versions
CVE-2020-36942
CVE-2020-36942 affects Victor CMS 1.0: authenticated users can upload PHP files via the profile image upload, enabling a PHP shell in the /img directory and browser-based command execution. The entry notes high impact to confidentiality, integrity, and availability. The documents do not provide a...
PT-2026-4924
Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0 Description Victor CMS version 1.0 has a file upload issue. Authenticated users can upload malicious PHP files through the profile image upload feature. An attacker can upload a PHP shell to the /img directory and execut...
CVE-2026-1412 Sangfor Operation and Maintenance Security Management System HTTP POST Request get_clip_img command injection
A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/getclipimg of the component HTTP POST Request Handler. Such manipulation of the argument frame/dirno leads to command...
Sangfor Operation and Maintenance Security Management System Command Injection Vulnerability
The Sangfor Operation and Maintenance Security Management System is a security management system developed by Sangfor Corporation in China. Versions of the Sangfor Operation and Maintenance Security Management System 3.0.12 and earlier had a command injection vulnerability. This vulnerability...
MiracleLinux 7 : qemu-kvm-1.5.3-105.el7.3 (AXSA:2016-049:01)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-049:01 advisory. qemu-kvm is an open source virtualizer that provides hardware emulation for the KVM hypervisor. qemu-kvm acts as a virtual machine monitor together with the K...
CVE-2022-50894
VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the imgid parameter. Attackers can send GET requests to editgalleryimage.php with malicious imgid values to extract database...
PT-2026-2370
Name of the Vulnerable Software and Affected Versions VIAVIWEB Wallpaper Admin version 1.0 Description The software contains an SQL injection issue that allows authenticated attackers to manipulate database queries. Attackers can inject SQL code through the img id parameter. Specifically, sending...
CVE-2023-45379
In the module "Rotator Img" posrotatorimg in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection...
SUSE-SU-2026:0068-1 Security update for libvirt
This update for libvirt fixes the following issues: - CVE-2025-13193: Fixed umask for 'qemu-img' when creating external inactive snapshots bsc1253703 - CVE-2025-12748: Fixed Check ACLs before parsing the whole domain XML bsc1253278...
Joomla! 6.x < 6.0.2 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 3.9.x prior to 5.4.2, or 6.x prior to 6.0.2. It is, therefore, affected by multiple vulnerabilities. - Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in...
CVE-2025-63082: Improper Neutralization of Input During Web Page Generation
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags...
Joomla! CMS 跨站脚本漏洞
Joomla! CMS is an open source content management system for Joomla! A cross-site scripting vulnerability exists in Joomla! CMS that stems from insufficient input filtering, which could lead to cross-site scripting attack vectors in the HTML filter code associated with the data URL in the img tag...
CVE-2025-12385 Improper validation of <img> tag size in Text component parser
Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick...
