300 matches found
CVE-2022-22124 Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser...
CVE-2022-22124: Improper Neutralization of Input During Web Page Generation
In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser...
CVE-2022-22124
In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser...
CVE-2021-37372
Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating their profile image to gain remote code execution...
CVE-2021-37372: Unrestricted Upload of File with Dangerous Type
Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating their profile image to gain remote code execution...
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
✍️ Description here is a Stored XSS on the user profile image uploader via svg file 🕵️♂️ Proof of Concept Step to reproduce: 1. Go to account profile 2. Click the choose file option to update profile image 3. Upload the svg file containing malicious code: or you can download it from :...
CVE-2021-32666
wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial of service between users. If a user has an invalid assetID for their profile picture and it contains the " character, it will cause the iO...
vFairs 代码问题漏洞
vFairs is a virtual event platform by vFairs Singapore. It can host exciting online conferences, trade shows, job fairs and more. A security vulnerability exists in vFairs 3.3, which stems from the fact that any user logged into a vFairs virtual meeting or event can abuse the functionality by...
OpenCart <= 3.0.3.8 Multiple XSS Vulnerabilities
OpenCart is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting
Exploit Title: 4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting Date: 30-12-2020 Exploit Author: Ritesh Gohil Vendor Homepage: https://www.4homepages.de/ Software Link: https://www.4homepages.de/download-4images Version: 1.7.11 Tested on: Windows 10/Kali Linux Vulnerable Parameters:...
4images 1.7.11 Cross Site Scripting
Exploit Title: 4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting Date: 30-12-2020 Exploit Author: Ritesh Gohil Vendor Homepage: https://www.4homepages.de/ Software Link: https://www.4homepages.de/download-4images Version: 1.7.11 Tested on: Windows 10/Kali Linux Vulnerable Parameters:...
OpenCart Cross-Site Scripting Vulnerability (CNVD-2020-75516)
OpenCart is a PHP-based open source online e-commerce solution. A cross-site scripting vulnerability exists in Profile Image in OpenCart 3.0.3.6. An attacker can exploit this vulnerability to upload and execute malicious code...
CVE-2020-29471
OpenCart 3.0.3.6 is affected by cross-site scripting XSS in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger...
CVE-2020-29471
OpenCart 3.0.3.6 is affected by cross-site scripting XSS in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger...
Cross site scripting
OpenCart 3.0.3.6 is affected by cross-site scripting XSS in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger...
CVE-2020-29471
OpenCart 3.0.3.6 is affected by stored cross-site scripting in the Profile Image feature. An administrator can upload a profile image containing JavaScript; when users view the profile image, the script executes, triggering XSS. The CVE entry CVE-2020-29471 is documented across multiple aggregato...
CVE-2020-29471: Improper Neutralization of Input During Web Page Generation
OpenCart 3.0.3.6 is affected by cross-site scripting XSS in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger...
Opencart 跨站脚本漏洞
OpenCart is a PHP-based open source online e-commerce solution. A cross-site scripting vulnerability exists in Profile Image in OpenCart 3.0.3.6. An attacker can exploit this vulnerability to upload and execute malicious code...
OpenCart 3.0.3.6 - 'Profile Image' Stored Cross-Site Scripting (Authenticated)
Exploit Title: OpenCart 3.0.3.6 - 'Profile Image' Stored Cross Site Scripting Authenticated Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.6 Tested on: Window...
OpenCart 3.0.3.6 Cross Site Scripting
Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.6 Tested on: Windows 10/Kali Linux Stor...