PT-2025-47010

Name of the Vulnerable Software and Affected Versions Bdtask/CodeCanyon News365 versions up to 7.0.3 Description A security flaw exists in Bdtask/CodeCanyon News365. The issue involves unrestricted file upload due to manipulation of the profile image/banner image argument within a function in the...

CVE-2025-7526

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion via renaming due to insufficient file path validation in the setuserprofileimage function in all versions up to, and including, 6.6.7. This makes it possible for...

WordPress plugin WP Travel Engine 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plug...

PT-2025-41357

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.6.7 Description The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress has a flaw that allows arbitrary file deletion through...

EUVD-2020-26672

Malware in sbrugna...

EUVD-2022-3069

Malicious code in bioql PyPI...

EUVD-2024-33939

Malicious code in bioql PyPI...

EUVD-2022-3392

Malicious code in bioql PyPI...

EUVD-2022-24391

Malicious code in bioql PyPI...

EUVD-2024-48667

Malicious code in bioql PyPI...

EUVD-2022-27273

Malicious code in bioql PyPI...

EUVD-2024-3235

Malicious code in bioql PyPI...

EUVD-2025-24650

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-3640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and...

PT-2025-34236 · Unopim · Unopim

Name of the Vulnerable Software and Affected Versions: UnoPim versions prior to 0.2.1 Description: The image upload functionality during user creation performs only client-side file type validation. An attacker can modify the file extension and content of an uploaded image to execute arbitrary co...

CVE-2025-55194

Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension e.g., .jpg.txt, resulting in a persistent 500 Internal Server Error when attempting to view or edit that...

CVE-2025-55194

Part-DB pre-1.17.3 allows any authenticated user to upload a profile picture with a misleading file extension (for example .jpg.txt), triggering a persistent 500 Internal Server Error when viewing or editing the user profile. This creates a Denial of Service in the user management UI for both use...

CVE-2025-7124 code-projects Online Note Sharing Profile Image userprofile.php unrestricted upload

A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. It is possible to...

Vigybag 安全漏洞

Vigybag is an e-commerce platform by Vigybag India. A security vulnerability exists in Vigybag v1.0 and earlier versions, which stems from the Upload Profile Image feature in My Profile being vulnerable to cross-site scripting attacks...

📄 ERPNext 15.53.1 Cross Site Scripting

ERPNext version 15.53.1 suffers from multiple persistent cross site scripting vulnerabilities. An authenticated user can inject malicious JavaScript into the userimage field of the profile page using an XSS payload within the file path or HTML context. This field is rendered without sufficient...