CVE-2026-90610

CVE-2026-90610 is a buffer over-read (heap, size 20) in the function gf_svg_attributes_copy within scenegraph/svg_attributes.c , part of the MP4Box component of the GPAC media framework. The flaw is reachable with local access and low privileges , requiring no user interaction. Impact is limited ...

PT-2026-91002

A vulnerability was found in GPAC up to f1219cde. This affects the function gf svg attributes copy of the file scenegraph/svg attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made publi...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: XSS Almacenado a Toma de Control de Cuenta en TastyIgniter v4.3.0 📌 Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS Almacenado en la funcionalidad de carga de archivos del Media Manager de TastyIgniter v4.3.0. Debido a una validación y saneamiento insuficiente...

Z-Downloads < 1.11.7 - Cross-Site Scripting

The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. id: CVE-2024-8673 info: name: Z-Downloads 1.11.7 - Cross-Site Scripting author: Splint3r7 severity: low description: | The plugin does not properly validate uploaded files...

SiYuan <= v3.5.9 - Cross Site Scripting

SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon. id: CVE-2026-31809 info: name: SiYu...

SiYuan <= v3.5.9 - SVG Animate Element XSS

SiYuan = v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization allowing SVG animation elements to inject executable JavaScript in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute scripts. id: CVE-2026-31807 info: name: SiYuan = v3.5.9 - SVG Animate...

SiYuan Note - Cross-Site Scripting

Unauthenticated reflected cross-site scripting XSS vulnerability in all versions of SiYuan Note containing /api/icon/getDynamicIcon with unsafe type=8 rendering logic. Attacker-controlled content is inserted directly into SVG output without proper sanitization. An attacker can execute arbitrary...

Imgproxy < 3.14.0 - Cross-site Scripting (XSS)

Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0. id: CVE-2023-1496 info: name: Imgproxy 3.14.0 - Cross-site Scripting XSS author: pdteam severity: medium description: Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to...

CVE-2020-29599

CVE-2020-29599 librería ImageMagick de Artifex Artifex versión 6.9.11-40 y 7.0.10-40 archivos SVG serán convertidos a imágenes...

CVE-2022-32074

CVE-2022-32074 for osTicket | 支持工单系统 root@kitploit: 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it 示例：...

CVE-2023-43838

CVE-2023-43838 An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar. Additional Information 1. Create alert.svg with the following content: root@kitploit:...

CVE-2023-33977

CVE-2023-33977 kiwitcms/kiwi 中通过 SVG 上传导致的存储型 XSS - 作者：M Nadeem Qazi 描述 本仓库针对在 kiwitcms/kiwi 应用中发现并被分配了 CVE-2023-33977 标识符的存储型 XSS 漏洞进行了说明。该漏洞允许通过 SVG 文件上传执行恶意脚本。当上传包含恶意载荷的 SVG 文件时，脚本会在受害者浏览器的上下文中执行，可能导致数据窃取、账户失陷以及恶意软件的传播。 概念验证 有关此漏洞的详细概念验证可参阅以下视频： 影响 该漏洞影响重大，对 kiwitcms/kiwi...

CVE-2025-51858

CVE-2025-51858 漏洞描述 ChatPlayground.ai 是一款用于比较 AI 模型的流行 Web 应用程序。其聊天组件存在跨站脚本 XSS 漏洞，可导致 JWT 令牌窃取和远程账户劫持。此外，/api/chat-history 端点存在弱访问控制 IDOR。攻击者可利用此 IDOR，通过 JWT 令牌中的用户名访问受害者的聊天历史，即使在 JWT 令牌过期后也可导致隐私数据泄露。 攻击向量 ChatPlayground.ai 是一款用于比较 AI 模型的流行 Web 应用程序。在 ChatPlayground.ai（一个流行的 AI 模型比较平台）的聊天组件...

ImageTragick-CVE-2016-3714-RShell

ImageTragick-CVE-2016-3714-RShell 这些是利用bash、nc、php等工具构建反向Shell的CVE-2016-3714 mvg/svg POC。 声明 仅供研究和道德黑客使用…… 用法 1. 服务器端：nc -l - p 端口号 2. 将图片上传到漏洞站点 致谢 感谢virgoTeam的ding提供的php反向Shell POC 参考 https://imagetragick.com/ root@kitploit: jpeanut@VirgoTeam...

CVE-2025-50738-PoC

CVE-2025-50738 这非常简单，通过SVG实现存储型XSS是野外发现跨站脚本漏洞的常见方式，所以这是我首先尝试的方法之一。 我通过Pikapods部署了usememos，然后导航到首页并创建了一个账户。 使用该账户，我创建了一个"想法"： 然后我创建了一个SVG文件，包含以下payload： root@kitploit: 该payload执行JavaScript，导致打印'document.domain'（所以它只显示'.pikapod.net'）。 我选择了文件，在本例中它叫xss6.svg，然后我可以"复制图片地址"：...

CVE-2024-7703

CVE-2024-7703 root@kitploit: Exploit CVE-2024-7703: Cross-Site Scripting XSS Almacenado mediante Carga de Archivos SVG en el Plugin ARMember de WordPress Descripción general Este repositorio contiene un exploit de prueba de concepto PoC para la vulnerabilidad identificada como CVE-2024-7703. La...

svg_phishing_tools

Kit de herramientas de análisis de seguridad SVG - Documentación de la herramienta Este kit de herramientas contiene herramientas Python especializadas para analizar archivos SVG potencialmente maliciosos y detectar mecanismos de seguridad. Resumen El kit consta de cuatro herramientas principales...

CVE-2022-32060

Snipe-IT 版本 v6.0.2 漏洞说明： Snipe-IT v6.0.2 的更新品牌设置组件中存在任意文件上传漏洞，攻击者可通过构造的文件执行任意代码。 攻击向量： 我们发现了一个文件上传漏洞，当在更新品牌设置页面上传恶意文件时触发。 Payload： https://github.com/bypazs/GrimTheRipper/blob/main/GrimTheRipperTeam.svg 测试环境： 1. Snipe-IT 版本 v6.0.2 2. Google Chrome 版本 102.0.5005.61 官方构建 64位 受影响组件：...

CVE-2023-39115

CVE-2023-39115 Descripción: Campcodes Online Matrimonial Website System Script v3.3 es vulnerable a una vulnerabilidad de carga arbitraria de archivos, lo que potencialmente permite a los atacantes ejecutar código arbitrario en el servidor objetivo. La vulnerabilidad surge de una validación...

CVE-2025-61183

CVE-2025-61183 Stored XSS in User Avatar Upload via Unsafe SVG Handling Overview A Stored Cross-Site Scripting XSS vulnerability was identified in the vaahcms, specifically within the interaction between the file upload logic in MediaController.php and the storeAvatar method in UserBase.php,...