EUVD-2026-35044

A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting wh...

EUVD-2021-23899

Malware in sbrugna...

EUVD-2022-33257

Malicious code in bioql PyPI...

EUVD-2021-30974

Malicious code in bioql PyPI...

CVE-2025-45055

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

CVE-2025-45055

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

CVE-2022-3137

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user such as subscriber creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file...

CVE-2021-37794

A stored cross-site scripting XSS vulnerability exists in FileBrowser v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the...

Exploit for Code Injection in Webkul Krayin_Crm

CVE-2025-3568 Privilege Escalation via Malicious SVG File...

Adobe Character Animator 4.0.0 < 4.4.7 / 22.0 < 22.4 Arbitrary code execution (APSB22-21) (macOS)

The version of Adobe Character Animator installed on the remote macOS host is prior to 22.4, 4.4.7. It is, therefore, affected by a vulnerability as referenced in the APSB22-21 advisory. - Adobe Character Animator versions 4.4.2 and earlier and 22.3 and earlier are affected by an out-of- bounds...

Server-Side Request Forgery (SSRF)

Apache XML Graphics Batik is vulnerable to Server-Side Request Forgery SSRF. An attacker is able to trick the application into loading a malicious SVG file, which could then be used to cause excess resource consumption or make unauthorized requests to other systems...

Stored XSS

Description Due to insufficient validation of uploaded files - bad actors can upload malicious SVG file with XSS payload. That leads to Stored XSS. Because accessToken cookie has valid HttpOnly flag, can not take victims cookie there in this way, but please keep in mind that XSS in general is abo...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to cross site scripting. The vulnerability exists in the NewServer function of server.go because of a image direct link due to improper user-input sanitization by uploading a malicious svg file...

Cross site scripting

Adobe Character Animator versions 4.4.2 and earlier and 22.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicio...

CVE-2022-28819

CVE-2022-28819 affects Adobe Character Animator versions 4.4.2 (and earlier) and 22.3 (and earlier). The issue is an out-of-bounds write vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicio...

Design/Logic Flaw

Adobe Dimension versions 3.4.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim...

CVE-2021-39823

Adobe svg-native-viewer 8182d14dfad5d1e10f53ed830328d7d9a3cfa96d and earlier versions are affected by a heap buffer overflow vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is...

CVE-2020-5810

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload...

Denial Of Service (DoS)

librsvg is vulnerable to denial of service. An attacker is able to cause a resource exhaustion via a malicious SVG file containing nested patterns...

SVG nanosvg Library Memory Corruption / Denial Of Service

The SVG library nanosvg 0 suffers from a memory corruption bug that can lead to at least DoS. The bug exists in the nsvgparseColorRGB function, which can be reached by parsing a malicious SVG file through nsvgParseFromFile or nsvgParse. This should also affect libraries/packages that provide...