24 matches found
CVE-2025-51858
CVE-2025-51858 漏洞描述 ChatPlayground.ai 是一款用于比较 AI 模型的流行 Web 应用程序。其聊天组件存在跨站脚本 XSS 漏洞，可导致 JWT 令牌窃取和远程账户劫持。此外，/api/chat-history 端点存在弱访问控制 IDOR。攻击者可利用此 IDOR，通过 JWT 令牌中的用户名访问受害者的聊天历史，即使在 JWT 令牌过期后也可导致隐私数据泄露。 攻击向量 ChatPlayground.ai 是一款用于比较 AI 模型的流行 Web 应用程序。在 ChatPlayground.ai（一个流行的 AI 模型比较平台）的聊天组件...
CVE-2023-44767_RiteCMS-File-Upload--XSS---Filemanager
RiteCMS 3.0 文件上传 - XSS 作者: Sergio 描述： RiteCMS 3.0 中的文件上传漏洞允许本地攻击者上传包含 XSS 内容的 svg 文件。 攻击向量： AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L POC： 我们创建一个包含以下内容的 svg 文件： root@kitploit: 登录面板后，我们将进入管理菜单的"文件管理器"部分，然后点击"上传文件"。 这里我们看到 svg 文件上传成功： 然后我们打开该文件，XSS 弹窗出现： 附加信息： https://github.com/handylulu/RiteCMS/...
CVE-2025-3568
CVE-2025-3568 通过恶意 SVG 文件实现权限提升 概述 已在 Krayin CRM 2.1.0 中发现一个安全漏洞，该漏洞允许低权限用户通过诱骗管理员打开恶意 SVG 文件来提升权限。此漏洞利用基于 SVG 的跨站请求伪造（CSRF）和 跨站脚本（XSS），以实现： 从 Cookie 中窃取管理员的 XSRF 令牌 。 通过未受保护的 API 端点 ，在不知道当前密码的情况下更改管理员密码。 这可能导致管理员账户被完全接管 和数据泄露 。 技术细节 漏洞类型 通过 SVG 文件上传实现 CSRF + XSS （存储型客户端攻击） 访问控制失效 （无需当前密码即可更改密码）...
CVE-2026-82838
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
SUSE CVE-2026-73648
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...
SUSE CVE-2026-45627
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution...
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Stored XSS to Account Takeover via Model Profile Images in Open WebUI Affected: Open WebUI tags. On the output side, users.py added a MIME allowlist check and X-Content-Type-Options: nosniff. The fix was applied to UserUpdateForm, UpdateProfileForm, and later to ChannelWebhookForm. Three models...
CVE-2026-42138
Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This...
CVE-2026-33311
DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options backgroundColor, fontFamily, textColor were not XML-escaped before interpolation into SVG...
CVE-2026-30948
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting XSS vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is served inline with...
CVE-2026-32940 SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:image/svg+xml in href attributes but misses data:text/xml and data:application/xml, both of which can render SVG with JavaScript execution. Th...
OPENSUSE-SU-2026:20323-1 Security update for roundcubemail
This update for roundcubemail fixes the following issues: Changes to roundcubemail: Update to 1.6.13: This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: + Fix CSS injection vulnerability reported by CERT Polsk...
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
Summary A Cross-Site Scripting XSS vulnerability exists in the ui.interactiveimage component of NiceGUI v3.3.1 and earlier. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG tag. Detail...
CVE-2025-66512 Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside...
CVE-2025-66512 Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside...
CVE-2025-66512 Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside...
EUVD-2023-0483
Malicious code in bioql PyPI...
CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover
Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...
PT-2024-17544
Name of the Vulnerable Software and Affected Versions Jirafeau affected versions not specified Description The issue concerns a case insensitive MIME type bypass that enables SVG XSS in Jirafeau. Normally, Jirafeau prevents browser preview for SVG files to prevent cross-site scripting exploitatio...