CVE-2025-65676

CVE-2025-65676 Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India. Affected Product: ClassroomIO Affected Version: 0.1.13 Discovered...

CVE-2025-56514

CVE-2025-56514: Cross Site Scripting XSS Vulnerability in Fiora Chat Application Overview A Cross Site Scripting XSS vulnerability, identified as CVE-2025-56514 , affects the Fiora chat application version 1.0.0. This vulnerability allows an authenticated user to execute arbitrary JavaScript in t...

CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112 – XXE via SVG Image Upload Program Code Python Flask + XML parser root@kitploit: xxeuploadserver.py - Uploads SVG, renders with lxml resolving entities from flask import Flask, request from lxml import etree app = Flaskname @app.route'/upload', methods='POST' def uploadsvg: svgdata...

CVE-2026-5615

CVE-2026-5615 — VvvebJs Stored Cross-Site Scripting RXSS Overview This repository contains a Python proof-of-concept PoC script demonstrating a Stored Cross-Site Scripting RXSS vulnerability affecting VvvebJs ⚠️ This project is intended strictly for authorized security testing , educational...

CVE-2024-50803-Redaxo

CVE-2024-50803 XSS almacenado en la función mediapool de Redaxo Se encontró una vulnerabilidad de cross-site scripting XSS almacenado en las versiones de Redaxo 5.18.0, que permite a atacantes con privilegios suficientes subir un archivo SVG malicioso a través de la función mediapool. Publicado u...

CVE-2026-84695

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-84695 BookStack before 26.05.4 Stored XSS via Drawing Upload

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

EUVD-2026-69786

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-84695

BookStack versions before 26.05.4 are affected by a stored cross-site scripting (XSS) vulnerability in the drawing upload endpoint , which accepts unvalidated base64 content and stores it without content inspection. Attackers holding editor permissions can upload SVG files containing scripts that...

CVE-2026-82838

Venueless 's default Docker image had a vulnerability where uploaded SVG files could be served with executable JavaScript content, potentially allowing stored XSS. The root cause was the absence of a proper Content Security Policy (CSP) in the image's default configuration. The fix sets a valid C...

EUVD-2026-68392

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

EUVD-2026-42996

Snipe-IT vulnerable to stored XSS via inline-served attachment...

WordPress JetEngine plugin < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) vulnerability

Unauthenticated Stored XSS via Form File Upload SVG vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin JetEngine versions 3.8.13.1...

CVE-2024-50803-Redaxo

CVE-2024-50803 XSS memorizzato nella funzionalità mediapool di Redaxo Una vulnerabilità di cross-site scripting XSS memorizzato è stata trovata in Redaxo versioni 5.18.0, consentendo a un attaccante con privilegi sufficienti di caricare un file SVG malevolo attraverso la funzionalità mediapool...

CVE-2026-79670 Ech0 before 4.4.3 Stored XSS via SVG Upload

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...

CVE-2026-79670 Ech0 before 4.4.3 Stored XSS via SVG Upload

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...

CVE-2026-79670

Ech0 before 4.4.3 contains a stored cross-site scripting (XSS) vulnerability in its file upload endpoint . The root cause is that the endpoint validates the Content-Type header using only client-supplied values without performing server-side inspection of the uploaded file. An attacker with admin...

CVE-2026-78337

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

EUVD-2026-64825

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...