CVE-2025-12163 Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting

The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-12163

CVE-2025-12163 affects the Omnipress WordPress plugin (versions ≤ 1.6.3). It describes a stored cross-site scripting vulnerability via SVG file uploads, caused by insufficient input sanitization and output escaping. Exploitation requires Author-level access or higher, and payloads can execute in ...

EUVD-2025-201327

Malicious code in react-svg-fill npm...

Malicious code in react-svg-fill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995c6ef17232fb1949de6b62053246036337cb070a7b06a466bb122d789c9ca3 The package react-svg-fill was found to contain malicious code. Source: ghsa-malware b09c58dca53550942f8c2595496e45d321f85551e7ce7a94e7059e50448f4709...

MAL-2025-192313 Malicious code in react-svg-fill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995c6ef17232fb1949de6b62053246036337cb070a7b06a466bb122d789c9ca3 The package react-svg-fill was found to contain malicious code. Source: ghsa-malware b09c58dca53550942f8c2595496e45d321f85551e7ce7a94e7059e50448f4709...

Malicious code in react-svg-bundler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0653c3340d723105ee0db3b1e440d764e9c750287b1f50e796b4ce847ddaee46 The package react-svg-bundler was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-201329

Malicious code in react-svg-bundler npm...

MAL-2025-192312 Malicious code in react-svg-bundler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0653c3340d723105ee0db3b1e440d764e9c750287b1f50e796b4ce847ddaee46 The package react-svg-bundler was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-svg-supporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf2d6b643ae6f9563baf5e18621fe86ff8f764a2254785e2300c96aa397a0bc The package react-svg-supporter was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-201328

Malicious code in react-svg-supporter npm...

MAL-2025-192314 Malicious code in react-svg-supporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf2d6b643ae6f9563baf5e18621fe86ff8f764a2254785e2300c96aa397a0bc The package react-svg-supporter was found to contain malicious code. Source: ghsa-malware...

PT-2025-49204

The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

AlmaLinux 10 : qt6-qtsvg (ALSA-2025:22394)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:22394 advisory. qtsvg: Uncontrolled recursion in Qt SVG module CVE-2025-10728 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory...

EUVD-2025-201263

Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS via the downloadPdf function for Notes feature. An attacker can execute arbitrary JavaScript code and steal session tokens by importing a specially crafted Markdown file containing...

CVE-2025-65959

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing...

CVE-2025-65959 Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing...

CVE-2025-65959 Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing...

CVE-2025-65959

CVE-2025-65959 concerns a stored XSS in Open WebUI’s Notes PDF download feature. The vulnerability arises when HTML content from a Markdown note is assigned directly to innerHTML during PDF generation, enabling arbitrary JavaScript execution (e.g., SVG-based payloads) and session-token theft. Exp...

CVE-2025-65516

A stored cross-site scripting XSS vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the lin...