CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-55074

Affected software: Grocy, prior to version 4.3.0. Vulnerability: stored cross-site scripting (XSS) in the edit profile function triggered by uploading crafted HTML or SVG files, leading to privilege escalation. Root cause/impact: manipulation via file upload within the edit profile path; implicat...

Grocy 安全漏洞

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A security vulnerability exists in Grocy 4.3.0 and earlier versions, which stems from vulnerability to a stored cross-site scripting attack that can be achieved by uploading specially crafted HTML or SVG...

PT-2025-3093 · Grocy · Grocy

Name of the Vulnerable Software and Affected Versions: Grocy versions prior to 4.3.0 Description: The issue in the edit profile function of Grocy allows stored Cross Site Scripting XSS and resultant privilege escalation by uploading a crafted HTML or SVG file. Recommendations: For versions prior ...

CVE-2024-13141 osuuu LightPicture SVG File Upload upload cross site scripting

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotel...

CVE-2024-13141 osuuu LightPicture SVG File Upload upload cross site scripting

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotel...

CVE-2024-13141 osuuu LightPicture SVG File Upload upload cross site scripting

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotel...

PT-2025-2027 · Unknown · Osuuu Lightpicture

Name of the Vulnerable Software and Affected Versions: osuuu LightPicture versions 1.2.2 and earlier Description: A problematic vulnerability was found in osuuu LightPicture, affecting unknown code of the file "/api/upload" of the component SVG File Upload Handler. The manipulation of the argumen...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the lack of proper sanitization of uploaded SVG files. An attacker can execute malicious scripts by uploading specially crafted SVG files. This is only exploitable if the attacker has author-level access ...

GHSA-J77F-79W9-RGHC The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184 WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184 WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184

The CVE-2024-11184 issue affects the wp-enable-svg WordPress plugin, specifically versions 0.7 and earlier, where uploaded SVG files are not sanitized. The underlying vulnerability enables stored XSS, with exploitation possible by users with author-level access or higher, potentially delivering m...

WordPress plugin WP Enabled SVG 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-1629 · WordPress · Wp-Enable-Svg

Name of the Vulnerable Software and Affected Versions: wp-enable-svg WordPress plugin versions 0.7 and earlier wp-enable-svg WordPress plugin versions 0.2 and earlier Description: The issue is related to the wp-enable-svg WordPress plugin, which does not sanitize SVG files when uploaded. This...

PT-2025-54197

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-12 Description ImageMagick is software used for editing and manipulating digital images. Prior to version 7.1.2-12, reading a malicious SVG file with Magick could lead to a denial-of-service DoS attack...

WordPress WP-SVG plugin <= 0.9 - Contributor+ Stored XSS via Shortcode vulnerability

Contributor+ Stored XSS via Shortcode vulnerability discovered by Bob Matyas in WordPress Plugin WP-SVG versions = 0.9...