1935 matches found
CVE-2022-25037
An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...
CVE-2024-56940
An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service DoS via excessive file uploads...
CVE-2024-56940
An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service DoS via excessive file uploads...
PT-2025-6732 · Learndash · Learndash
Name of the Vulnerable Software and Affected Versions: LearnDash version 6.7.1 Description: An issue in the profile image upload function of LearnDash allows attackers to cause a Denial of Service DoS via excessive file uploads. Recommendations: For LearnDash version 6.7.1, consider restricting...
LearnDash 安全漏洞
LearnDash is a learning management system from LearnDash, Inc. A security vulnerability exists in LearnDash version v6.7.1, which stems from a problem with the profile image upload feature that can cause a denial of service by uploading too many files...
CVE-2024-10239
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specially crafted image, which can cause a stack overflow due to the unchecked fat-fsd.maxfld...
CVE-2025-24372
CVE-2025-24372 affects CKAN when a registered user uploads a specially crafted file, enabling execution of code that can trigger arbitrary server requests and potentially escalate privileges for the submitter or others. The issue is tied to user-upload handling and can be exploited if upload rest...
CVE-2024-29891
ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in th...
CVE-2024-1491
The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory...
CVE-2024-10238
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld-usedbytes...
CVE-2024-10238
CVE-2024-10238 affects Supermicro MBD-X12DPG-OA6 firmware image verification. The root cause is a stack overflow caused by not checking fld->used_bytes in the verification path. Public sources in the connected documents describe two related stack-overflow flaws in the firmware image verificati...
CVE-2024-10238 fld->used_bytes without sanity check causes stack overflow
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld-usedbytes...
SuperMicro MBD-X12DPG-OA6 安全漏洞
The SuperMicro MBD-X12DPG-OA6 is a processor from SuperMicro USA. A security vulnerability exists in the Supermicro MBD-X12DPG-OA6. An attacker exploiting this vulnerability could upload a specially crafted image resulting in a stack overflow...
Supermicro MBD-X12DPG-OA6 安全漏洞
The SuperMicro MBD-X12DPG-OA6 is a processor from SuperMicro USA. A security vulnerability exists in the Supermicro MBD-X12DPG-OA6. An attacker exploiting this vulnerability could upload a specially crafted image resulting in a stack overflow...
Cross-site Scripting (XSS)
Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient validation of uploaded SVG images. A user with SVG upload privileges who convinces another user to...
CVE-2025-25063
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, ...
PT-2025-5616 · Unknown · Backdrop Cms
Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.28.x through 1.28.4 Backdrop CMS versions 1.29.x through 1.29.2 Description: A security issue was discovered related to the validation of uploaded SVG images. These images can contain clickable links and executable...
WordPress Social Share Buttons for WordPress plugin <= 2.7 - Unauthenticated Image Upload & Path Traversal vulnerability
Unauthenticated Image Upload & Path Traversal vulnerability discovered by Bob Matyas in WordPress Plugin Social Share Buttons for WordPress versions = 2.7...