Phishing attacks leveraging HTML code inside SVG files

With each passing year, phishing attacks feature more and more elaborate techniques designed to trick users and evade security measures. Attackers employ deceptive URL redirection tactics, such as appending malicious website addresses to seemingly safe links, embed links in PDFs, and send HTML...

CVE-2025-3056

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-3056 Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-3056

The CVE-2025-3056 entry pertains to the WordPress Download Manager plugin and is an authenticated Stored Cross-Site Scripting vulnerability via SVG file uploads. It affects all versions up to 3.3.12 due to insufficient input sanitization and output escaping, allowing an Author+ or higher to injec...

Unspecified vulnerability in Huawei HarmonyOS (CNVD-2025-15528)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a security issue in the SVG parsing module, and can be exploited by an attacker to affe...

PT-2025-17287 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.3.12 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

Unspecified vulnerability in Huawei HarmonyOS (CNVD-2025-15556)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from an SVG parsing module exception capture failure, and can be exploited by an attacker to...

Unspecified vulnerability in Huawei HarmonyOS (CNVD-2025-15557)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from an SVG parsing module exception capture failure, and can be exploited by an attacker to...

Huawei HarmonyOS buffer overflow vulnerability (CNVD-2025-11087)

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from a buffer overflow vulnerability that stems from a security issue in the SVG parsing module, which can be exploited by an attacker to affect availability...

WordPress plugin Download Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Exploit for Code Injection in Webkul Krayin_Crm

CVE-2025-3568 Privilege Escalation via Malicious SVG File...

CVE-2024-50807

Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting XSS via file upload using the svg and pdf extensions...

AZL-60542 CVE-2025-22872 affecting package gh for versions less than 2.62.0-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

CVE-2025-3568

A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be...

CVE-2025-3568

A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be...

CVE-2025-3568 Webkul Krayin CRM SVG File edit cross site scripting

A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be...

CVE-2025-3568

CVE-2025-3568 affects Webkul Krayin CRM

CVE-2025-3568 Webkul Krayin CRM SVG File edit cross site scripting

A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be...

CVE-2025-3568 Webkul Krayin CRM SVG File edit cross site scripting

A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be...

PT-2025-16218

Name of the Vulnerable Software and Affected Versions: Webkul Krayin CRM versions up to 2.1.0 Description: A vulnerability has been found in the SVG File Handler component of Webkul Krayin CRM, affecting an unknown functionality of the file /admin/settings/users/edit/. The manipulation leads to...