1493 matches found
WordPress Cost Calculator Builder Pro plugin <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload vulnerability
Unauthenticated Cross-Site Scripting via SVG Upload vulnerability discovered by andrea bocchetti in WordPress Plugin Cost Calculator Builder Pro versions = 3.1.67...
CVE-2024-3344
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2024-25261 · WordPress · The Otter Blocks – Gutenberg Blocks
Name of the Vulnerable Software and Affected Versions: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress versions up to, and including, 2.6.8 Description: The issue is related to Stored Cross-Site Scripting via SVG file upload due to insufficient...
PT-2024-21998 · Unknown · Huly Platform
Name of the Vulnerable Software and Affected Versions: Huly Platform version 0.6.202 Description: The issue allows attackers to execute arbitrary code via the upload of a crafted SVG file to issues, which is a result of a Cross Site Scripting vulnerability. Recommendations: For Huly Platform...
CVE-2024-29273
There is Stored Cross-Site Scripting XSS in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document...
Debian dsa-5642 : php-dompdf-svg-lib - security update
The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5642 advisory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5642-1...
WordPress Scalable Vector Graphics (SVG) Plugin <= 3.4 is vulnerable to Cross Site Scripting (XSS)
Software Scalable Vector Graphics SVG Type Plugin Vulnerable versions = 3.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7085 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 893df7114366 Credits Bob Matyas...
CVE-2023-7085 Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG
The Scalable Vector Graphics SVG WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2023-7085 Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG
The Scalable Vector Graphics SVG WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
WordPress Plugin Scalable Vector Graphics Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
PT-2024-15207 · WordPress · Scalable Vector Graphics
Name of the Vulnerable Software and Affected Versions: Scalable Vector Graphics SVG WordPress plugin versions through 3.4 Description: The issue arises from the Scalable Vector Graphics SVG WordPress plugin's failure to sanitize uploaded SVG files. This could allow users with a role as low as...
Fedora: Security Advisory for batik (FEDORA-2024-129d8ca6fc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 40 Update: batik-1.14-13.fc40
Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...
Huly Platform Security Vulnerability
Huly Platform is an open source all-in-one project management platform. A security vulnerability exists in hcengineering Huly Platform version v.0.6.202. An attacker can exploit the vulnerability by uploading a specially crafted SVG file to run arbitrary code...
Arbitrary Code Execution
phenx/php-svg-lib is vulnerable to Arbitrary Code Execution. The vulnerability due to lack of validation of the font-family attribute. An attacker can parse a Scalable Vector Graphics SVG containing a PHAR url within the the font family attribute, potentially leading to arbitrary code execution...
Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG
Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC Upload an SVG with the following code: Access the uploaded file directly to see the XSS...
JetBrains Toolbox Security Vulnerability
JetBrains Toolbox is a JetBrains product management application from JetBrains Czech Republic. A security vulnerability previously existed in the JetBrains Toolbox App version 2.2, which stemmed from a DoS attack that could be performed via a malicious SVG image...
PT-2024-14857 · B&R · B&R Automation Runtime
Name of the Vulnerable Software and Affected Versions: B&R Automation Runtime versions = G4.93 Description: A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager that enables a remote attacker to execute arbitrary JavaScript code in the context...
WordPress plugin Easy SVG Allow security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...