AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (ALMALINUX9.2:CLSA-2026:1771497630)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771497630 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to...

AlmaLinux 9.2 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.2:CLSA-2026:1788452050)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788452050 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read loca...

CVE-2025-63830

📂 CKFinder 1.4.3 – Cross-Site Scripting XSS Almacenado mediante Carga de SVG Malicioso CVE ID: CVE-2025-63830 🧭 Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS almacenado en CKFinder v1.4.3. El problema reside en la funcionalidad de carga de archivos , que no sanitiza...

CVE-2026-94545

CVE-2026-94545 Next.js next/og RCE no autenticado ★ CVE-2026-94545 Next.js next/og inyección SVG a RCE nativo ★ https://github.com/user-attachments/assets/e297b40b-36ad-4a9a-b0c1-a64429bc0160 Descripción general next/og construye imágenes Open Graph renderizando JSX a un SVG con Satori y luego...

CVE-2023-23924

CVE-2023-23924 Dompdf vulnerable a fallo de validación de URI en el análisis de SVG · CVE-2023-23924 · GitHub Advisory Database https://github.com/advisories/GHSA-3cw5-7cxw-v5qg Ejecución Terminal 1 ❯ cd www ❯ php -S 127.0.0.1:9000 -t . Terminal 2 ❯ cd src ❯ php cve202323924.php Comprobación...

Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098

Magnolia CMS = 6.2.19 Cross-Site Scripting Almacenado CVE-2022-33098 Tabla de Contenidos 1. Visión General 2. Descripción Detallada 3. Prueba de Concepto 4. Solución 5. Cronología de Divulgación 6. Referencias 7. Créditos 8. Avisos Legales Visión General Revisión: 1.0 Impacto: Cross-Site Scriptin...

firefox: thunderbird: Use-after-free in the SVG component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component...

firefox: thunderbird: Use-after-free in the SVG component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component...

EUVD-2026-88582

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

CVE-2026-102366

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

Ubuntu 24.04 LTS : Emacs vulnerability (USN-8835-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8835-1 advisory. It was discovered that Emacs improperly handled specially crafted SVG images, resulting in memory corruption. An attacker could possibly use this issue to cause...

CVE-2022-32074

CVE-2022-32074 para osTicket | Sistema de Ticketing de Soporte 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it Ejemplo:...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: XSS Almacenado a Toma de Control de Cuenta en TastyIgniter v4.3.0 📌 Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS Almacenado en la funcionalidad de carga de archivos del Media Manager en TastyIgniter v4.3.0. Debido a una validación y sanitización insuficient...

CVE-2026-102366 mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

CVE-2026-102366 mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: Una ranura de reserva a XSS de administrador Encontré un XSS almacenado no autenticado en el plugin de WordPress WP Time Slots Booking Form. Una presentación de reserva pública controla parte del valor de la ranura de tiempo almacenada. El plugin luego imprime ese valor en la pági...

-CVE-2025-0133-GlobalProtect-XSS

mitsecvpnxssexploit 🔓 Exploit para el endpoint SSL VPN de GlobalProtect /ssl-vpn/getconfig.esp que añade un payload XSS manipulado a la URL. Uso python3 exploit.py -u https://target.com Parámetros -u, --url: URL base del objetivo no incluyas parámetros de consulta Vista previa del payload...

Ghost-CMS-Exploit

Ghost-CMS-Exploit Ghost-CMS Exploit es un script de Python. Este script primero realiza intentos de autenticación por fuerza bruta utilizando las listas de palabras proporcionadas. Si se encuentran credenciales válidas, procede a verificar la vulnerabilidad CVE-2024-23724 y genera un payload de...

USN-8835-1 emacs vulnerability

It was discovered that Emacs improperly handled specially crafted SVG images, resulting in memory corruption. An attacker could possibly use this issue to cause Emacs to crash, resulting in a denial of service, or obtain sensitive information...

USN-8835-1: Emacs vulnerability

It was discovered that Emacs improperly handled specially crafted SVG images, resulting in memory corruption. An attacker could possibly use this issue to cause Emacs to crash, resulting in a denial of service, or obtain sensitive information...