CVE-2024-5125

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting XSS and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upo...

CVE-2024-5125

CVE-2024-5125 affects parisneo/lollms-webui version 9.6, where SVG processing during file upload enables two issues: Cross‑Site Scripting (XSS) and Open Redirect. The root cause is inadequate input validation and handling of SVG files in the upload flow, allowing embedded JavaScript execution and...

CVE-2024-5125 XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting XSS and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upo...

LoLLMs 代码问题漏洞

LoLLMs is a Web UI for a large language multi-modal system by the individual developer Saifeddine ALOUI. A code issue vulnerability exists in LoLLMs version 9.6, which stems from the presence of a cross-site scripting XSS and open redirection vulnerability that allows an attacker to embed malicio...

CVE-2024-9307 mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files

The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute...

CVE-2024-9307

CVE-2024-9307 affects the mFolio Lite WordPress plugin. The vulnerability is due to a missing capability check in all versions up to 1.2.1, allowing authenticated attackers with Author-level access or higher to upload SVGs/EXEs and inject scripts that execute on page load or file access, with pot...

Remote Code Execution (RCE)

Umbraco is vulnerable to remote code execution. The vulnerability is due to improper handling of SVG files, where script tags within these files are not properly validated or stripped, allowing potential code execution when previewed by Backoffice users in full-screen mode...

CVE-2024-51492

CVE-2024-51492 affects Zusam prior to 0.5.6. A specially crafted SVG uploaded as an image enables stored XSS with unrestricted script execution on image load, potentially exfiltrating the user’s long‑lived session token/API key (valid indefinitely unless rotated). Version 0.5.6 fixes the vulnerab...

CVE-2024-51492 Zusam vulnerable to stored XSS, allowing token theft via crafted SVG

Zusam is a free and open-source way to self-host private forums. Prior to version 0.5.6, specially crafted SVG files uploaded to the service as images allow for unrestricted script execution on raw image load. With certain payloads, theft of the target user’s long-lived session token is possible...

GHSA-CM59-8RMV-F2CJ Lollms vulnerable to Cross-site Scripting

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

Lollms vulnerable to Cross-site Scripting

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

CVE-2024-6581 Remote Code Execution due to Stored XSS in parisneo/lollms

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

CVE-2024-6581

Summary: CVE-2024-6581 matches a vulnerability in Lollms (v9.9) where the SVG upload filter in sanitize_svg fails to neutralize all SVG-based vectors, enabling cross-site scripting (XSS) and potentially remote code execution when an authorized user accesses a crafted SVG URL. What’s affected: Lol...

GHSA-5955-CWV4-H7QH Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process...

CVE-2024-48927

Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full...

CVE-2024-48927 Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full...

CVE-2024-48927 Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full...

Adobe Illustrator < 25.0 Multiple Vulnerabilities (APSB20-53) (macOS)

The version of Adobe Illustrator installed on the remote macOS host is prior to 25.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB20-53 advisory. - Adobe Illustrator version 24.1.2 and earlier is affected by a memory corruption vulnerability that occurs when...

CVE-2024-9539

An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to uplo...

CVE-2024-9539

CVE-2024-9539 affects GitHub Enterprise Server prior to 3.14, where an information-disclosure flaw allowed an attacker to retrieve a user’s metadata by triggering via an uploaded asset URL (involving malicious SVG files) and then craft phishing pages. The vulnerability is fixed in 3.14.2, and als...