1883 matches found
CVE-2024-40513
An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function...
Themesbrand ChatVia 安全漏洞
Themesbrand ChatVia is a responsive chat application from Themesbrand. A security vulnerability exists in Themesbrand ChatVia version 5.3.2, which originates from a vulnerability that allows remote attackers to execute arbitrary code via the user profile image upload function...
Themesbrand Chatvia 安全漏洞
Themesbrand ChatVia is a responsive chat application from Themesbrand. A security vulnerability exists in Themesbrand Chatvia version 5.3.2, which stems from the presence of an insecure privilege vulnerability that allows an attacker to elevate privileges via the user's profile name and image...
PT-2025-2583 · Themesebrand · Themesebrand Chatvia
Name of the Vulnerable Software and Affected Versions: themesebrand Chatvia version 5.3.2 Description: An issue in themesebrand Chatvia allows a remote attacker to execute arbitrary code via the User profile Upload image function. Recommendations: For themesebrand Chatvia version 5.3.2, consider...
CVE-2024-54730
Flatnotes v5.3.1 is vulnerable to denial of service through the upload image function...
PT-2025-3896 · Opencart · Blog Botz For Journal Theme
Name of the Vulnerable Software and Affected Versions: Blog Botz for Journal Theme version 1.0 on OpenCart Description: A critical vulnerability was found in Blog Botz for Journal Theme on OpenCart, affecting an unknown part of the file /index.php?route=extension/module/blog add. The manipulation...
CVE-2024-54730
CVE-2024-54730 covers a denial-of-service in Flatnotes versions prior to 5.3.1, caused by the image upload function. The vulnerability is observed in the web interface where uploading an image can exhaust resources, leading to service disruption. Public records across multiple sources confirm the...
flatnotes 安全漏洞
flatnotes is a self-hosted, database-less notes web application by the individual developer Adam Dullage. A security vulnerability exists in flatnotes version v5.3.1 that originates from a denial of service via the upload image feature...
PT-2025-3065 · Flatnotes · Flatnotes
Name of the Vulnerable Software and Affected Versions: Flatnotes versions prior to 5.3.1 Description: The issue is related to a denial of service through the upload image function. There is no information provided about the estimated number of potentially affected devices worldwide or real-world...
CVE-2025-0335
A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been...
CVE-2025-0335
A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been...
CVE-2025-0335
The CVE-2025-0335 entry concerns code-projects Online Bike Rental System 1.0, where the Change Image Handler component exposes an unrestricted upload path. The documented impact is remote, with the ability to upload arbitrary files, leading to a high-severity outcome (per multiple sources). Concr...
Code-Projects Content Management System 代码问题漏洞
Code-Projects Content Management System is an open source content and management system from Code-Projects. A code issue exists in Code-Projects Content Management System version 1.0 due to an unrestricted upload of the parameter image...
CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload
Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...
CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload
Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...
WordPress plugin MStore API 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...
CVE-2024-12233
A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /registration.php of the component Profile Picture Handler. The manipulation of the argument img leads to unrestricted upload. The attack may...
CVE-2024-11661
A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file profile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. The...
CVE-2024-10482
The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...