Inflectra SpiraTeam 安全漏洞

Inflectra SpiraTeam is a project management software from Inflectra, Inc. It is used for the management and delivery of software development and testing projects. A security vulnerability exists in Inflectra SpiraTeam version 7.2.00, which stems from the fact that uploading specially crafted SVG...

Cross-site Scripting (XSS)

Overview contao/core-bundle is an Open Source PHP Content Management System for people who want a professional website that is easy to maintain. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the uploadTo function in FileUpload.php. An attacker can execute scripts...

Contao 跨站脚本漏洞

Contao is Contao open source a set of open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. Contao suffers from a cross-site scripting vulnerability that stems from the fact that users can upload SVG files...

Cross-site Scripting (XSS)

Overview modx/revolution is a Content Management System. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of user-uploaded SVG files in the profile image upload feature. Authenticated users can upload SVG files containing malicious JavaScri...

WordPress WP SVG Upload plugin <= 1.0.0 - Author+ Stored XSS via SVG vulnerability

Author+ Stored XSS via SVG vulnerability discovered by Pierre Rudloff in WordPress Plugin WP SVG Upload versions = 1.0.0...

PublicCMS 代码问题漏洞

PublicCMS is an open source content management system CMS written in Java language by PublicCMS China. A security vulnerability exists in PublicCMS version v4.0.202406, which originates from the /cms/CmsWebFileAdminController.java component that allows the upload of specially crafted svg or xml...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper handling of SVG uploads. An attacker can inject malicious scripts and potentially redirect users to malicious websites by uploading specially crafted SVG files. Details Cross-site scripting or XS...

PT-2025-7320 · WordPress · Svg Support Plugin

Name of the Vulnerable Software and Affected Versions: SVG Support plugin for WordPress versions up to and including 2.5.10 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-7346 · WordPress · C9 Admin Dashboard

Name of the Vulnerable Software and Affected Versions: C9 Admin Dashboard plugin for WordPress versions up to, and including, 1.3.5 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

The vulnerability of the dashboard diagram description function in the Apache Superset visualization software allows attackers to perform cross-site scripting attacks.

The vulnerability of the control panel diagram description function in Apache Superset data visualization software is related to the lack of measures taken to protect the structure of web pages during the processing of SVG elements. Exploiting this vulnerability allows a remote attacker to perfor...

WordPress plugin SVG Support 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

Astra Linux – Vulnerability in imagemagick

A vulnerability was discovered in ImageMagick. This security flaw manifests as undefined behaviors when using double to type as sizet in svg, mvg, and other code segments reoccurring bugs of CVE-2022-32546...

ZOO-Project 跨站脚本漏洞

ZOO-Project is an open source processing platform from ZOO-Project Open Source. A cross-site scripting vulnerability exists in ZOO-Project that stems from the EchoProcess service failing to perform proper security checks on SVG content when processing user input...

CVE-2024-11623 Stored XSS in authentik

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release...

Cross-site Scripting (XSS)

Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient validation of uploaded SVG images. A user with SVG upload privileges who convinces another user to...

Backdrop CMS 安全漏洞

Backdrop CMS is a content management system CMS from Backdrop CMS open source. A security vulnerability exists in Backdrop CMS version 1.28.x prior to version 1.28.5 and version 1.29.x prior to version 1.29.3, which stems from insufficient validation of uploaded SVG images and makes it vulnerable...

CVE-2025-25063

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, ...

PT-2025-5616 · Unknown · Backdrop Cms

Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.28.x through 1.28.4 Backdrop CMS versions 1.29.x through 1.29.2 Description: A security issue was discovered related to the validation of uploaded SVG images. These images can contain clickable links and executable...

WordPress plugin goodlayers-core 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in...

InnoShop 安全漏洞

InnoShop is an open source e-commerce system based on Laravel 11 by InnoShop Open Source. A security vulnerability exists in InnoShop V.0.3.8 and earlier versions, which stems from vulnerability to cross-site scripting XSS attacks via SVG file upload...