715 matches found
CVE-2023-7089 Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG
The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2024-23348
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote...
PT-2024-19827 · Unknown · A-Blog Cms
Name of the Vulnerable Software and Affected Versions: a-blog cms versions prior to 3.1.7 a-blog cms versions prior to 3.0.29 a-blog cms versions prior to 2.11.58 a-blog cms versions prior to 2.10.50 a-blog cms version 2.9.0 and earlier Description: The issue is related to improper input...
Umbraco Cross-Site Scripting Vulnerability
Umbraco is an open source Content Management System CMS written in C by the Danish company Umbraco. Umbraco suffers from a cross-site scripting vulnerability that originates from a user with access to the backend being able to upload SVG files containing scripts. The script can be executed if the...
PT-2023-32743 · WordPress · Svg Support
Name of the Vulnerable Software and Affected Versions: SVG Support plugin for WordPress versions up to, and including, 2.5.5 Description: The issue is related to Stored Cross-Site Scripting via the SVG upload feature due to insufficient input sanitization and output escaping. This allows...
Cross site scripting
A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...
CVE-2023-50465
A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...
CVE-2023-50465
A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...
PT-2023-31568 · Monica · Monica
Name of the Vulnerable Software and Affected Versions: Monica aka MonicaHQ version 4.0.0 Description: A stored cross-site scripting XSS vulnerability exists in the software via an SVG document uploaded by an authenticated user. Recommendations: For version 4.0.0, consider restricting the upload o...
CVE-2023-5458
The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
PT-2023-26042 · Neos Cms · Neos Cms
Name of the Vulnerable Software and Affected Versions: Neos CMS version 8.3.3 Description: The issue allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file uploaded to the neos/management/media component. To exploit this, the attacker must be able to upload a...
Cross Site Scripting (XSS)
matrix-media-repo is vulnerable to a Cross Site Scripting XSS. The vulnerability is due to a lack of content-type validation, which allows an attacker to upload a SVG image containing JavaScript leading to the execution of JavaScript in the user’s browser...
Exploit for Unrestricted Upload of File with Dangerous Type in Campcodes Complete_Online_Matrimonial_Website_System_Script
CVE-2023-39115 Description: Campcodes Online Matrimonial Webs...
GHSA-R47V-RXCG-P28J Stored Cross-Site Scripting October CMS
An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users...
Perch v3.2 - Stored XSS Vulnerability
Exploit Title: Perch v3.2 - Stored XSS Application: Perch Cms Version: v3.2 Bugs: XSS Technology: PHP Vendor URL: https://grabaperch.com/ Software Link: https://grabaperch.com/download Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC ========================================...
CVE-2023-2143
The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability...
CVE-2023-2143
The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability...
CVE-2023-2143 Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS
The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability...
WordPress plugin Enable SVG, WebP & ICO Upload 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...