CVE-2023-33977

CVE-2023-33977 Stored XSS Via SVG Upload in kiwitcms/kiwi - by M Nadeem Qazi Description This repository addresses the stored XSS vulnerability discovered in the kiwitcms/kiwi application, which was assigned the CVE-2023-33977 identifier. The vulnerability allows for the execution of malicious...

CVE-2026-5615

CVE-2026-5615 — VvvebJs Cross-Site Scripting Almacenado RXSS Descripción general Este repositorio contiene un script de prueba de concepto PoC en Python que demuestra una vulnerabilidad de Cross-Site Scripting Almacenado RXSS que afecta a VvvebJs ⚠️ Este proyecto está destinado estrictamente a...

CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112 – XXE mediante la carga de imágenes SVG Código del programa Python Flask + analizador XML root@kitploit: xxeuploadserver.py - Uploads SVG, renders with lxml resolving entities from flask import Flask, request from lxml import etree app = Flaskname @app.route'/upload', methods='POST...

CVE-2025-60880

CVE-2025-60880: Cross-Site Scripting XSS Almacenado en el Panel de Administración de Bagisto Existe una vulnerabilidad de XSS almacenado autenticado en la ruta de creación de productos del panel de administración de Bagisto 2.3.6, que permite a un atacante subir un archivo SVG manipulado que...

CVE-2024-48591

CVE-2024-48591 Offenlegung einer Sicherheitslücke: XSS in Inflectra SpiraTeam 7.2.00 Beschreibung Inflectra SpiraTeam Version 7.2.00 ist anfällig für Cross-Site Scripting XSS durch das Hochladen speziell gestalteter SVG-Dateien, die JavaScript ausführen können, wenn sie direkt angezeigt werden. A...

Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098

Magnolia CMS = 6.2.19 Cross Site Scripting Armazenado CVE-2022-33098 Índice 1. Visão Geral 2. Descrição Detalhada 3. Prova de Conceito 4. Solução 5. Linha do Tempo de Divulgação 6. Referências 7. Créditos 8. Avisos Legais Visão Geral Revisão: 1.0 Impacto: Cross site scripting armazenado no Magnol...

CVE-2026-27621

CVE-2026-27621：TypiCMS Core 存在存储型跨站脚本攻击（XSS），通过 SVG 文件上传 概述...

CVE-2025-61183

CVE-2025-61183 通过不安全的 SVG 处理在用户头像上传中实现存储型 XSS 概述 在 vaahcms 中发现了一个存储型跨站脚本（XSS）漏洞，具体存在于 MediaController.php 中的文件上传逻辑与 UserBase.php 中的 storeAvatar 方法之间的交互中，允许低权限的注册用户上传包含嵌入式 JavaScript 的恶意 SVG 文件。该漏洞源于文件存储发生在内容或 MIME 类型验证 之前 ，导致恶意文件留在服务器上可预测且可公开访问的路径中。 该漏洞源于 MediaController.php 中的 upload 方法 $path =...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: XSS Armazenado para Tomada de Conta no TastyIgniter v4.3.0 📌 Resumo Uma vulnerabilidade de Cross-Site Scripting XSS Armazenado foi identificada na funcionalidade de upload de arquivos do Gerenciador de Mídia no TastyIgniter v4.3.0. Devido à validação e sanitização insuficientes de...

CVE-2023-50465

MonicaHQ XSS Exploitation de la XSS MonicaHQ Créer un compte Créer un contact Dans Documents, téléverser un fichier SVG malveillant root@kitploit: alert"Monicahq XSS Poc"; Accéder au fichier téléversé...

CVE-2024-7703

Exploit CVE-2024-7703: Cross-Site Scripting XSS Memorizzato tramite Caricamento di File SVG nel Plugin WordPress ARMember Panoramica Questo repository contiene un proof-of-concept PoC per la vulnerabilità identificata come CVE-2024-7703. La vulnerabilità riguarda il Plugin WordPress ARMember, in...

poc-cve-xss-uploading-svg

Dettagli Titolo: Cross-Site Scripting Riflessa Autenticata nel Plugin "Uploading SVG, WEBP and ICO files" per WordPress CMS Data: 2023-08-10 Autore: Danilo Albuquerque Homepage del Venditore: https://wordpress.org Link del Software: https://wordpress.org/download Versione: WordPress 6.3 Nome e...

CVE-2024-50803-Redaxo

CVE-2024-50803 XSS memorizzato nella funzionalità mediapool di Redaxo Una vulnerabilità di cross-site scripting XSS memorizzato è stata trovata in Redaxo versioni 5.18.0, consentendo a un attaccante con privilegi sufficienti di caricare un file SVG malevolo attraverso la funzionalità mediapool...

CVE-2023-34845

CVE-2023-34845 POC della vulnerabilità per CVE-2023-34845 Vulnerabilità Ho trovato un attacco di cross-site scripting sulla pagina di creazione di nuovi contenuti http://localhost:800/admin/new-content eseguirà lo script nel contesto dell'utente, consentendo all'attaccante di accedere a qualsiasi...

CVE-2024-50803-Redaxo

CVE-2024-50803 XSS persistente nella funzionalità mediapool di Redaxo È stata trovata una vulnerabilità di cross-site scripting persistente XSS nelle versioni di Redaxo 5.18.0, che consente ad attaccanti con privilegi sufficienti di caricare un file SVG dannoso tramite la funzionalità mediapool...

CVE-2026-79670 Ech0 before 4.4.3 Stored XSS via SVG Upload

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...

CVE-2026-79670

Ech0 before 4.4.3 contains a stored cross-site scripting (XSS) vulnerability in its file upload endpoint . The root cause is that the endpoint validates the Content-Type header using only client-supplied values without performing server-side inspection of the uploaded file. An attacker with admin...

CVE-2026-79670 Ech0 before 4.4.3 Stored XSS via SVG Upload

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...

thingsboard-ssrf-cve-2025-34282

CVE-2025-34282 — ThingsBoard SSRF über SVG-Bild-Upload Übersicht Sicherheitslücke zur Server-Side Request Forgery SSRF in ThingsBoard IoT-Plattform-Versionen vor 4.2.1. Ein Angreifer mit Tenant-Admin-Zugriff kann eine manipulierte SVG-Datei mit einer internen URL-Referenz über die...

CVE-2025-56515

CVE-2025-56515 Cross-Site Scripting XSS Schwachstelle in der Fiora Chat-Anwendung CVE-2025-56515: Cross-Site Scripting XSS Schwachstelle in der Fiora Chat-Anwendung Schwachstellenübersicht CVE-ID : CVE-2025-56515 Schwachstellentyp : Cross-Site Scripting XSS Angriffsart : Remote Auswirkung :...