CVE-2025-28355

CVE-2025-28355 经发现，https://github.com/Volmarg/personal-management-system 应用程序存在CSRF攻击漏洞，攻击者可执行的操作之一是诱骗合法用户发起跨站请求，从而修改其密码，使攻击者能够访问该应用程序。该漏洞需要浏览器的“SameSite”Cookie属性默认值为 none 的浏览器（如Firefox）才能利用。 向量字符串 : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS评分 : 4.7 概念验证 为进行演示，我将使用用户名 tester，并将其密码更改为...

CVE-2023-43838

CVE-2023-43838 个人管理系统（Personal Management System）v1.4.64 中存在一个任意文件上传漏洞，攻击者可通过将精心构造的 SVG 文件上传到用户个人资料的头像中，从而执行任意代码。 附加信息 1. 创建 alert.svg，内容如下： alert"huntr.dev"; 2. 将 .SVG 托管在 Web 服务器上。 3. 将 .SVG 作为头像图片上传。 4. 当用户在新标签页中打开头像时，存储于 .SVG 文件中的 javascript 将被执行。 参考资料：...

CVE-2026-40526: Improper Limitation of a Pathname to a Restricted Directory

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...

CVE-2023-43838

An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar...

EUVD-2025-11801

Malicious code in bioql PyPI...

EUVD-2025-12206

Malicious code in bioql PyPI...

EUVD-2025-12366

Malicious code in bioql PyPI...

EUVD-2025-12364

Malicious code in bioql PyPI...

EUVD-2023-48201

Malicious code in bioql PyPI...

EUVD-2025-12265

Malicious code in bioql PyPI...

EUVD-2024-26329

Malicious code in bioql PyPI...

EUVD-2025-11798

Malicious code in bioql PyPI...

CVE-2024-29318

Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting XSS via upload of a SVG file with embedded javascript code...

CVE-2024-29319

Volmarg Personal Management System 1.4.64 is vulnerable to SSRF Server Side Request Forgery via uploading a SVG file. The server can make unintended HTTP and DNS requests to a server that the attacker controls...

CVE-2025-29456

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function...

CVE-2025-29454

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function...

CVE-2025-29455

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Travel Ideas" function...

CVE-2025-29453

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings component...

CVE-2025-28355

Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery CSRF allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none...

CVE-2024-53568

A stored cross-site scripting XSS vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the tag parameter...