150 matches found
EUVD-2021-31658
Malicious code in bioql PyPI...
EUVD-2025-25656
Malicious code in bioql PyPI...
CVE-2025-41031
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...
CVE-2025-41031 Multiple vulnerabilities in Deporsite by T-INNOVA
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...
CVE-2025-41031 Multiple vulnerabilities in Deporsite by T-INNOVA
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...
CVE-2025-41031
CVE-2025-41031 affects Deporsite by T-INNOVA. The root cause is a lack of authorization that allows an unauthenticated attacker to change other users’ profile pictures by sending a POST request to /ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage with IdPersona and Foto. The CVE entry lists a C...
CVE-2025-9406
A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...
CVE-2025-9406 xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload
A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...
CVE-2025-9406 xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload
A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...
CVE-2025-9406
A vulnerability is identified in xuhuisheng lemon up to 1.13.0 affecting the uploadImage function in CmsArticleController.java (com.mossle.cms.web.CmsArticleController.uploadImage). The Upload argument is manipulated to enable unrestricted uploads, with remote initiation and a publicly available ...
PT-2025-34592 · Unknown · Xuhuisheng Lemon
Name of the Vulnerable Software and Affected Versions: xuhuisheng lemon versions through 1.13.0 Description: A weakness exists in xuhuisheng lemon up to version 1.13.0. This issue affects the uploadImage function within the CmsArticleController.java file, specifically in the...
CVE-2025-7477
A vulnerability, which was classified as critical, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/addcars.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. Th...
CVE-2025-6108
Vulnerability CVE-2025-6108 affects hansonwang99 Spring-Boot-In-Action up to a specific commit. The path-traversal flaw is in the watermarkTest function of ImageUploadService.java under the File Upload component, allowing remote exploitation. Multiple sources confirm the issue and public disclosu...
CVE-2023-31544
A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...
CVE-2020-14988
An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...
CVE-2024-10481
CVE-2024-10481 is a CSRF vulnerability in comfyanonymous/comfyui
PT-2025-9695
Name of the Vulnerable Software and Affected Versions hzmanyun Education and Training System version 2.1.3 Description A critical vulnerability has been found in the hzmanyun Education and Training System. This affects the scorm function of the UploadImageController.java file. The manipulation of...
PT-2025-6606 · WordPress · Profilegrid
Name of the Vulnerable Software and Affected Versions: ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.9.4.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary...