PT-2023-28337 · Bluespice · Bluespice

Name of the Vulnerable Software and Affected Versions: BlueSpice affected versions not specified Description: A Cross-site Scripting XSS issue in the BlueSpiceAvatars extension of BlueSpice allows a logged-in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This...

BlueSpice Security Vulnerabilities

BlueSpice is free Wiki software from BlueSpice based on the MediaWiki engine. A security vulnerability exists in BlueSpice, which stems from a cross-site scripting XSS vulnerability in the BlueSpiceAvatars extension. The vulnerability can be exploited to inject arbitrary HTML code into the profil...

Exact Synergy Enterprise 代码问题漏洞

Exact Synergy Enterprise is a platform from Dutch company Exact that handles all business processes and integrates them with ERP systems. A security vulnerability exists in Exact Synergy Enterprise versions prior to 267 267SP13 and Exact Synergy Enterprise versions prior to 500 500SP6, which stem...

GHSA-7VRP-3PFF-C3J4 OpenCart Stored Cross-Site Scripting

OpenCart 3.0.3.6 is affected by cross-site scripting XSS in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger...

OpenCart Stored Cross-Site Scripting

OpenCart 3.0.3.6 is affected by cross-site scripting XSS in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger...

WordPress WPQAs plugin authorization issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress WPQAs plugin versions prior to 5.2 are vulnerable to an authorization issue that stems...

October CMS XSS In Caption Tag of Profile

Cross-site scripting XSS vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image...

GHSA-9HQ8-V2JC-QJ4R October CMS XSS In Caption Tag of Profile

Cross-site scripting XSS vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image...

Cross-site Scripting (XSS)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the profile image in the User settings section can be run in the update or in the uploa...

Camaleon CMS vulnerable to Stored Cross-site Scripting

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false...

GHSA-7F84-9CQF-G4J9 Camaleon CMS vulnerable to Stored Cross-site Scripting

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false...

CVE-2022-1044

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

CVE-2022-1044

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

Design/Logic Flaw

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

CVE-2022-1044 Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

Medical Hub Directory Site 1.0 Shell Upload Vulnerability

Title: Medical Hub Directory Site 1.0 Shell Upload Author: Hejap Zairy Vendor: https://www.sourcecodester.com/php/15252/simple-medical-hub-directory-site-phpoop-source-code.html Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/mhds.zip Reference:...

Sensitive Data Exposure Due To Insecure Storage Of Profile Image

Description When the user uploads his profile picture, the uploaded image’s EXIF Geolocation Data does not get stripped. As a result, anyone can get sensitive information of trudesk users like their Geolocation, their Device information like Device Name, Version, Software & Software version used,...

Microweber 安全漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An information disclosure vulnerability exists in versions of Microweber prior to 1.3, which stems from the fact that when...

CVE-2021-45310

Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted b...

CVE-2022-22124 Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image

In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser...