PT-2024-35166 · Unopim · Unopim

Name of the Vulnerable Software and Affected Versions: UnoPim versions prior to 0.1.5 Description: A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...

Clibo Manager 跨站脚本漏洞

Clibo Manager is a management platform from Clibo Manager, Inc. providing sports clubs with the ability to manage subscriptions and ticket sales, as well as direct contact with subscribers, events, sales statistics, and more. A cross-site scripting vulnerability exists in Clibo Manager version...

PT-2024-30669 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.9.10 Description: The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of th...

CVE-2024-7813

A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials...

CVE-2024-7813

A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials...

CVE-2024-7813 SourceCodester Prison Management System Profile Image insufficiently protected credentials

A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials...

CVE-2024-7813 SourceCodester Prison Management System Profile Image insufficiently protected credentials

A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials...

CVE-2024-7813

CVE-2024-7813 affects SourceCodester Prison Management System 1.0, specifically the Profile Image Handler via /uploadImage/Profile/. The issue arises from unknown processing of the profile image file, leading to credentials that are insufficiently protected. Exploitation is possible remotely and ...

PT-2024-37603 · WordPress · Profilegrid

Name of the Vulnerable Software and Affected Versions: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.8.9 Description: The issue is related to Insecure Direct Object Reference. It affects the pm upload image function due to missing...

Mattermost Improper Access Control Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an improper access control vulnerability. An attacker could exploit the vulnerability to cause changes to the profile image of a user belonging to another remote server connecte...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an improper access control vulnerability. An attacker could exploit the vulnerability to cause changes to the profile image of a user belonging to another remote server connecte...

CVE-2024-5639

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'restapichangeprofileimage' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-27747

File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component...

Petrol Pump Management Software Cross-Site Scripting Vulnerability

Petrol Pump Management Software is a gasoline pump management software by mayurik individual developer. A cross-site scripting vulnerability exists in Petrol Pump Management Software version v.1.0, which originates from a vulnerability that allows an attacker to execute arbitrary code with a...

GHSA-FR72-9665-W3GR Duplicate Advisory: Unrestricted file upload of user avatar images

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xrvh-rvc4-5m43. This link is maintained to preserve external references. Original Description An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute...

Duplicate Advisory: Unrestricted file upload of user avatar images

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xrvh-rvc4-5m43. This link is maintained to preserve external references. Original Description An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute...

CVE-2024-26483

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file...

Design/Logic Flaw

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file...

CVE-2024-26483

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file...

CVE-2024-26483

CVE-2024-26483 affects Kirby CMS v4.1.0: an unrestricted file upload in the Profile Image module allows arbitrary code execution via a crafted PDF. The issue is confirmed by multiple sources (Veracode/GitHub advisory) and is mitigated by upgrades to Kirby releases (e.g., 3.6.6.5, 3.7.5.4, 3.8.4.3...