10978 matches found
CVE-2025-45893
OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting XSS attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded...
CVE-2025-45893
OpenCart 4.1.0.4 is affected by CVE-2025-45893: Stored XSS via unsanitized SVG uploads in the media manager (blog posts). Attackers can embed JavaScript in SVGs uploaded for posts; this can execute in a user’s browser when viewed. Root cause: insufficient sanitization of uploaded SVG files. CVSSv...
CVE-2025-45893
OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting XSS attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded...
CVE-2025-45893
OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting XSS attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded...
PT-2025-30911 · Opencart · Opencart 4.1.0.4
Name of the Vulnerable Software and Affected Versions: OpenCart version 4.1.0.4 Description: OpenCart version 4.1.0.4 is susceptible to a Stored Cross-Site Scripting XSS attack through the upload of SVG files used in blog posts. The issue occurs because SVG files uploaded via the media manager ar...
CVE-2025-51863
Self Cross Site Scripting XSS vulnerability in ChatGPT Unli ChatGPTUnli.com thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG file to the chat interface...
Cross-Site Scripting (XSS)
bagisto/bagisto is vulnerable to Cross-Site Scripting. The vulnerability is due to improper validation of uploaded SVG files, which allows an attacker to execute arbitrary code via a crafted file upload...
CVE-2025-51863
Self Cross Site Scripting XSS vulnerability in ChatGPT Unli ChatGPTUnli.com thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG file to the chat interface...
PT-2025-30421 · Unknown · Chatgpt Unli
Name of the Vulnerable Software and Affected Versions: ChatGPT Unli versions through 2025-05-26 Description: A self cross-site scripting XSS issue exists in ChatGPT Unli that allows attackers to execute arbitrary code. The issue is triggered by a crafted SVG file submitted to the chat interface...
CVE-2025-51858
Self Cross-Site Scripting XSS vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbitrary code and gain sensitive information via a crafted SVG file contents sent through the chat component...
CVE-2025-51858
The CVE-2025-51858 entry concerns a self XSS vulnerability in ChatPlayground.ai up to 2025-05-24, exploitable via crafted SVG content sent in the chat component. Affected software is ChatPlayground.ai (chat feature) with the root cause described as SVG content in chat triggering script execution ...
CVE-2025-51863
Self Cross Site Scripting XSS vulnerability in ChatGPT Unli ChatGPTUnli.com thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG file to the chat interface...
CVE-2025-51863
Self Cross Site Scripting XSS vulnerability in ChatGPT Unli ChatGPTUnli.com thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG file to the chat interface...
CVE-2025-51863
The CVE-2025-51863 issue is a Self-XSS vulnerability in ChatGPT Unli’s chat interface, exploitable via a crafted SVG file uploaded/submitted to the chat. The root cause is unsanitized SVG handling that allows arbitrary code execution, leading to cookie theft and potential remote account hijacking...
CVE-2025-6997
The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the trxaddonsgetsvgfromfile function on an...
CVE-2025-46000
An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...
Exploit for CVE-2025-51863
CVE-2025-51863 Vulnerability description ChatGPTUtil is...
CVE-2025-6997
The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the trxaddonsgetsvgfromfile function on an...
CVE-2025-6997
The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the trxaddonsgetsvgfromfile function on an...