CVE-2023-26771

Taskcafe 0.3.2 is vulnerable to Cross Site Scripting XSS. There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the...

CVE-2023-26771

Taskcafe version 0.3.2 is vulnerable to Cross-Site Scripting (XSS) due to a lack of filetype validation during SVG profile picture uploads. An authenticated attacker can exploit this by uploading a malicious SVG file containing an XSS payload, which triggers when a victim opens the file. As a tem...

CVE-2023-26771: Improper Neutralization of Input During Web Page Generation

Taskcafe 0.3.2 is vulnerable to Cross Site Scripting XSS. There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the...

CVE-2023-26771

Taskcafe 0.3.2 is vulnerable to Cross Site Scripting XSS. There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the...

Simbarashe Financial Services 2.9.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : Simbarashe Financial Services v2.9.0 IDOR Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bit...

CVE-2024-9198

Vulnerability in Clibo Manager v1.1.9.1 that could allow an attacker to execute an stored Cross-Site Scripting stored XSS by uploading a malicious .svg image in the section: Profile Profile picture...

CVE-2024-9198

Vulnerability in Clibo Manager v1.1.9.1 that could allow an attacker to execute an stored Cross-Site Scripting stored XSS by uploading a malicious .svg image in the section: Profile Profile picture...

CVE-2024-9198

CVE-2024-9198 : Stored Cross-Site Scripting in Clibo Manager v1.1.9.1 via uploading a malicious SVG in Profile > Profile picture. Affected component: profile picture upload handling in Clibo Manager. Evidence from multiple sources (NVD/NVD-derived, CVE records, CNNVD) confirms a stored XSS vul...

CVE-2024-9198 Stored Cross-Site Scripting vulnerability in Clibo Manager

Vulnerability in Clibo Manager v1.1.9.1 that could allow an attacker to execute an stored Cross-Site Scripting stored XSS by uploading a malicious .svg image in the section: Profile Profile picture...

CVE-2024-9198 Stored Cross-Site Scripting vulnerability in Clibo Manager

Vulnerability in Clibo Manager v1.1.9.1 that could allow an attacker to execute an stored Cross-Site Scripting stored XSS by uploading a malicious .svg image in the section: Profile Profile picture...

CVE-2024-9198: Improper Neutralization of Input During Web Page Generation

Vulnerability in Clibo Manager v1.1.9.1 that could allow an attacker to execute an stored Cross-Site Scripting stored XSS by uploading a malicious .svg image in the section: Profile Profile picture...

The vulnerability of the `load_input_picture` function in the FFmpeg multimedia library allows a hacker to execute arbitrary code.

The vulnerability of the loadinputpicture function in the FFmpeg multimedia library lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Online Notice Board System 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : Online Notice Board System project 1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozil...

BIT-GHOST-2024-23724

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...

eClass LMS 6.2.0 Shell Upload

==================================================================================================================================== | Title : eClass LMS v6.2.0 shell upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | | Vendo...

CVE-2024-8370: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument forceserveas with the input picture' leads to cross site scripting. T...

The vulnerability of Google Chrome’s Picture In Picture technology, which allows a hacker to manipulate the content of a URL string

The vulnerability of Google Chrome’s Picture In Picture technology is related to the distortion of important information in the user interface. Exploiting this vulnerability can allow a malicious actor to manipulate the content of the URL string using a specially created HTML page...

PT-2024-40832 · Git +1 · Gpac

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow crash. Technical details about the crash include the hevc ref pic lists modification, gf hevc parse nalu b...

TAIF LMS 5.8.0 Shell Upload

==================================================================================================================================== | Title : TAIF LMS v5.8.0 shell upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | | Vendor ...

WordPress pz-frontend-manager plugin < 1.0.6 - CSRF change user profile picture vulnerability

CSRF change user profile picture vulnerability discovered by Vuln Seeker Cybersecurity Team in WordPress Plugin pz-frontend-manager versions 1.0.6...