CVE-2024-9238 AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-9238

CVE-2024-9238 covers the WordPress plugin AVIF Uploader, where versions before 1.1.1 fail to sanitize uploaded SVGs, allowing an attacker with as little as Author privileges to inject XSS via an SVG file. Multiple connected sources confirm the vulnerability pattern (SVG sanitization bypass and st...

WordPress plugin AVIF Uploader 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-21377 · WordPress · Add Svg Support For Media Uploader

Name of the Vulnerable Software and Affected Versions: The Add SVG Support for Media Uploader | inventivo WordPress plugin versions 1.0.0 through 1.0.5 Description: The issue concerns the failure to sanitize uploaded SVG files, potentially allowing users with a role as low as Author to upload...

PT-2025-21542 · WordPress · Avif Uploader

Name of the Vulnerable Software and Affected Versions: AVIF Uploader versions prior to 1.1.1 Description: The issue concerns the AVIF Uploader WordPress plugin, where uploaded SVG files are not properly sanitized. This could allow users with a role as low as Author to upload malicious SVG files...

CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

PT-2025-20812

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Visual Composer affected versions not specified Description The issue arises when a privileged user uploads untrusted or malicious content, which upon deserialization, could compromise the confidentiality, integrity, and...

CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system. Recent assessments: Assessed Attacker...

SAP NetWeaver Visual Composer Metadata Uploader 安全漏洞

SAP NetWeaver Visual Composer Metadata Uploader is a component in SAP NetWeaver for uploading metadata. A deserialization vulnerability exists in SAP NetWeaver Visual Composer Metadata Uploader that originates from deserializing malicious content, which can be exploited by an attacker to cause a...

Active exploitation of SAP NetWeaver Visual Composer CVE-2025-31324

On Thursday, April 24, enterprise resource planning company SAP published a CVE and a day later, an advisory behind login for CVE-2025-31324, a zero-day vulnerability in NetWeaver Visual Composer that carries a CVSSv3 score of 10. The vulnerability arises from a missing authorization check in...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

CVE-2025-31324 CVE-2025-31324, SAP Exploit POST /developme...

VulnCheck KEV: CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content...

CVE-2025-31324

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...

SAP NetWeaver Visual Composer Metadata Uploader 代码问题漏洞

SAP NetWeaver Visual Composer Metadata Uploader is a tool for modeling assistance from SAP. A file upload vulnerability exists in SAP NetWeaver Visual Composer Metadata Uploader. The vulnerability is due to an unauthenticated agent uploading potentially malicious executable binaries because the...

Malicious code in anton-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3378 Malicious code in anton-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @sporta-technology/d11-web-components.file-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3329 Malicious code in @sporta-technology/d11-web-components.file-uploader (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-32370

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not...

CVE-2025-32370

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not...