CVE-2026-5615

CVE-2026-5615 — VvvebJs Stored Cross-Site Scripting RXSS Overview This repository contains a Python proof-of-concept PoC script demonstrating a Stored Cross-Site Scripting RXSS vulnerability affecting VvvebJs ⚠️ This project is intended strictly for authorized security testing , educational...

CVE-2024-2961-XXE-Exploit

CVE-2024-2961 CNEXT XXE Channel Adaptation Exploit Script Adapts the PHP file-read - RCE exploit script from Ambionics' official cnext-exploits to the SVG upload + XXE arbitrary file read scenario PolarisCTF 2026 "Avatar Uploader" type challenges. Prerequisites Target: Linux + glibc update...

CVE-2022-32060

Snipe-IT Version v6.0.2 Vulnerability Explanation: An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file. Attack Vectors: We found a vulnerability file upload, when we upload malicious file...

CVE-2024-7703

CVE-2024-7703 CVE-2024-7703 Exploit: Stored Cross-Site Scripting XSS via SVG File Upload in ARMember WordPress Plugin Overview This repository contains a proof-of-concept PoC exploit for the vulnerability identified as CVE-2024-7703. The vulnerability affects the ARMember WordPress Plugin,...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...

CVE-2026-117533

REDAXO versions 5.18.0 before 5.21.4 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the rex_media_service component. The root cause is that the service moves uploaded SVG files into the public media folder before the sanitization process occurs. Authenticated users wit...

CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112 – XXE via SVG Image Upload Program Code Python Flask + XML parser xxeuploadserver.py - Uploads SVG, renders with lxml resolving entities from flask import Flask, request from lxml import etree app = Flaskname @app.route'/upload', methods='POST' def uploadsvg: svgdata = request.data...

CVE-2023-50465

MonicaHQ XSS Exploitation of MonicaHQ XSS Create an account Create a contact In Documents, upload a malicious SVG file alert"Monicahq XSS Poc"; Access the uploaded file...

CVE-2025-63830

📂 CKFinder 1.4.3 – Stored Cross-Site Scripting XSS via Malicious SVG Upload CVE ID: CVE-2025-63830 🧭 Overview A stored Cross-Site Scripting XSS vulnerability was identified in CKFinder v1.4.3. The issue resides in the file upload functionality, which fails to properly sanitize SVG files containin...

Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098

Magnolia CMS = 6.2.19 Stored Cross Site Scripting CVE-2022-33098 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision: 1.0 Impact: Stored cross-site scripting in Magnolia CMS 6.2.19...

thingsboard-ssrf-cve-2025-34282

CVE-2025-34282 — ThingsBoard SSRF via SVG Image Upload Overview Server-Side Request Forgery SSRF vulnerability in ThingsBoard IoT Platform versions before 4.2.1. An attacker with Tenant Admin access can upload a crafted SVG file containing an internal URL reference via the Image Upload Gallery...

CVE-2023-34845

CVE-2023-34845 Vulnerability POC for CVE-2023-34845 Vulnerability I found a cross-site scripting attack on the new content creating page http://localhost:800/admin/new-content it will execute the script in user context allowing the attacker to access any cookies or sessions tokens retained by the...

CVE-2024-50803-Redaxo

CVE-2024-50803 Stored XSS in mediapool feature of Redaxo A stored cross-site scripting XSS vulnerability was found in Redaxo versions 5.18.0, allowing attackers with sufficient privileges to upload a malicious SVG file through the mediapool feature. Published a write-up :...

CVE-2025-65675

CVE-2025-65675 Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India. Affected Product: ClassroomIO Affected Version: 0.1.13...

CVE-2025-50738-PoC

CVE-2025-50738 It is quite simple, a stored XSS via SVG is a very common way of finding Cross-Site Scripting in the wild, so it was one of the first things I did. I deployed the usememos via Pikapods, where I then navigated to the front-page and created an account. With the account, I created a...

CVE-2023-33977

CVE-2023-33977 Stored XSS Via SVG Upload in kiwitcms/kiwi - by M Nadeem Qazi Description This repository addresses the stored XSS vulnerability discovered in the kiwitcms/kiwi application, which was assigned the CVE-2023-33977 identifier. The vulnerability allows for the execution of malicious...

CVE-2025-61183

CVE-2025-61183 Stored XSS in User Avatar Upload via Unsafe SVG Handling Overview A Stored Cross-Site Scripting XSS vulnerability was identified in the vaahcms, specifically within the interaction between the file upload logic in MediaController.php and the storeAvatar method in UserBase.php,...

CVE-2023-39115

CVE-2023-39115 Description: Campcodes Online Matrimonial Website System Script v3.3 is vulnerable to an arbitrary file upload vulnerability, potentially allowing attackers to execute arbitrary code on the targeted server. The vulnerability arises from insufficient validation of uploaded files,...

CVE-2025-65676

CVE-2025-65676 Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India. Affected Product: ClassroomIO Affected Version: 0.1.13 Discovered...

poc-cve-xss-uploading-svg

Details Title: Authenticated Reflected Cross-Site Scripting in "Uploading SVG, WEBP and ICO files" Plugin for WordPress CMS Date: 2023-08-10 Author: Danilo Albuquerque Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/download Version: WordPress 6.3 Plugin's Name and...