CVE-2025-60445

A stored Cross-Site Scripting (XSS) vulnerability exists in XunRuiCMS version 4.7.1 within the dayrui/Fcms/Library/Upload.php component. The root cause is insufficient validation of SVG file uploads , which enables an attacker to inject malicious JavaScript code. This script will execute automati...

CVE-2025-60451: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module...

CVE-2025-60450: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to...

CVE-2025-60452

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, specifically in the app\system\download\admin\downloadadmin.class.php component. The vulnerability allows attackers to upload malicious SVG...

CVE-2025-60445: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SVG file uploads in the dayrui/Fcms/Library/Upload.php component, allowing attackers to inject malicious JavaScript code that executes when th...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

📄 Fiora Chat 1.0.0 Cross Site Scripting

Fiora Chat version 1.0.0 suffers from a cross site scripting vulnerability. CVE-2025-56514: Cross Site Scripting XSS Vulnerability in Fiora Chat Application Overview A Cross Site Scripting XSS vulnerability, identified as CVE-2025-56514, affects the Fiora chat application version 1.0.0. This...

CVE-2025-11027

A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once aga...

CVE-2025-11027 givanz Vvveb SVG File cross site scripting

A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once aga...

CVE-2025-11027 givanz Vvveb SVG File cross site scripting

A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once aga...

CVE-2025-11027

The CVE-2025-11027 issue affects givanz Vvveb up to version 1.0.7.2, specifically in the SVG File Handler component. The root cause is a cross-site scripting vulnerability that could be triggered remotely. Exploitation is described as publicly available in referenced sources. Remediation provided...

CVE-2025-11027: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once aga...

Vvveb 安全漏洞

Vvveb is a powerful and easy-to-use CMS from Givan Individual Developers for building websites, blogs or e-commerce stores. A security vulnerability exists in Vvveb version 1.0.7.2 and earlier, which stems from an unknown functionality issue in the component SVG File Handler that could lead to...

PT-2025-39655

Name of the Vulnerable Software and Affected Versions givanz Vvveb versions up to 1.0.7.2 Description A cross-site scripting issue exists in the SVG File Handler component. This manipulation can be launched remotely. The exploit is publicly available. Recommendations Update to a version beyond...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the logoNavbar or logoLogin arguments in the SVG File Handler component of the /admin path. An attacker can inject and execute arbitrary scripts by supplying crafted input to these arguments. Details...

GHSA-4C44-R8RM-3P39 Mangati NovoSGA XSS vulnerability in /admin

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is...

Mangati NovoSGA XSS vulnerability in /admin

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is...

CVE-2025-10909

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is...

CVE-2025-10909 Mangati NovoSGA SVG File admin cross site scripting

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is...

CVE-2025-10909 Mangati NovoSGA SVG File admin cross site scripting

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is...