CVE-2020-29471

OpenCart 3.0.3.6 is affected by stored cross-site scripting in the Profile Image feature. An administrator can upload a profile image containing JavaScript; when users view the profile image, the script executes, triggering XSS. The CVE entry CVE-2020-29471 is documented across multiple aggregato...

Opencart 跨站脚本漏洞

OpenCart is a PHP-based open source online e-commerce solution. A cross-site scripting vulnerability exists in Profile Image in OpenCart 3.0.3.6. An attacker can exploit this vulnerability to upload and execute malicious code...

OpenCart 3.0.3.6 Cross Site Scripting

Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.6 Tested on: Windows 10/Kali Linux Stor...

OpenCart 3.0.3.6 - 'Profile Image' Stored Cross-Site Scripting (Authenticated)

Exploit Title: OpenCart 3.0.3.6 - 'Profile Image' Stored Cross Site Scripting Authenticated Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.6 Tested on: Window...

Osi.Ig - Information Gathering Instagram

The Instagram OSINT Tool gets a range of information from an Instagram account that you normally wouldn't be able to get from just looking at their profile The information includes: profile : user id, followers / following, number of uploads, profile img URL, business enum, external URL, joined...

Nextcloud: Leaked of Profile Image from URL changing

Chaning the email address of url will show other's profile images. Impact Leakage of Users Profile Pictures if known email...

CVE-2020-12849

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user...

CVE-2020-12849

CVE-2020-12849 affects Pydio Cells 2.0.4. The vulnerability is a Stored Cross-Site Scripting (XSS) in profile pictures: any user can upload a profile image (including SVGs with embedded JavaScript) that can be accessed via a direct URL by any user (authenticated or not). Exploitation can trigger ...

CVE-2020-5509

PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...

CVE-2020-5509

PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...

Remote code execution

PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image...

CVE-2020-5509

CVE-2020-5509 affects PHPGurukul Car Rental Project v1.0. It allows Remote Code Execution via an executable file uploaded as a new profile image, due to improper validation of uploaded files. Exploit details are described in Exploit-DB and PacketStorm reports, and PT-2020-18486 recommends restric...

PT-2020-18486 · Phpgurukul · Phpgurukul Car Rental Project

Name of the Vulnerable Software and Affected Versions: PHPGurukul Car Rental Project version 1.0 Description: The issue allows for Remote Code Execution via an executable file in an upload of a new profile image. Recommendations: For PHPGurukul Car Rental Project version 1.0, consider restricting...

UBUNTU-CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2018-18260

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."...

PT-2018-14386 · Camaleon · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS version 2.4 Description: A Stored XSS issue has been discovered in Camaleon CMS. The profile image in the User settings section can be exploited in the update/upload area via the "admin/media/upload?actions=false" endpoint. The...

CVE-2018-18260

Camaleon CMS (Ruby on Rails) vulnerability CVE-2018-18260 affects version 2.4 where a Stored XSS is possible via the User settings profile image upload path. The issue is triggered when a malicious payload is processed in the update/upload area through /admin/media/upload?actions=false, allowing ...

CVE-2018-6860

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture...

Arbitrary File Upload

Intelliants/subrion is vulnerable to arbitrary file upload. The application doesn't restrict the type of files which can be uploaded as a profile image. These files may be executed when the profile is rendered...

Mojoomla Annual Maintenance Contract Management System Arbitrary File Upload Vulnerability

Mojoomla Annual Maintenance Contract AMC Management System is a contract document management system. An arbitrary file upload vulnerability exists in profilesetting image handling in the Mojoomla AMC Management System. A remote attacker can exploit this vulnerability to upload arbitrary files...