CVE-2024-9238

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

SAP Netweaver Visual Composer Multiple Vulnerabilities (May 2025)

SAP NetWeaver Visual Composer is affected by multiple vulnerabilities, including the following: - SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of...

CVE-2024-9238

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-9238

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-7088 Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG

The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-7088 Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG

The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-9238 AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-9238 AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-9238

The AVIF Uploader WordPress plugin is vulnerable to Stored XSS in versions prior to 1.1.1 . The root cause is a lack of proper sanitization for uploaded SVG files , which allows users with roles as low as Author to upload malicious SVGs containing XSS payloads. To remediate this vulnerability, it...

PT-2025-21542 · WordPress · Avif Uploader

Name of the Vulnerable Software and Affected Versions: AVIF Uploader versions prior to 1.1.1 Description: The issue concerns the AVIF Uploader WordPress plugin, where uploaded SVG files are not properly sanitized. This could allow users with a role as low as Author to upload malicious SVG files...

PT-2025-21377 · WordPress · Add Svg Support For Media Uploader

Name of the Vulnerable Software and Affected Versions: The Add SVG Support for Media Uploader | inventivo WordPress plugin versions 1.0.0 through 1.0.5 Description: The issue concerns the failure to sanitize uploaded SVG files, potentially allowing users with a role as low as Author to upload...

WordPress plugin AVIF Uploader 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

SAP NetWeaver Visual Composer Metadata Uploader 安全漏洞

SAP NetWeaver Visual Composer Metadata Uploader is a component in SAP NetWeaver for uploading metadata. A deserialization vulnerability exists in SAP NetWeaver Visual Composer Metadata Uploader that originates from deserializing malicious content, which can be exploited by an attacker to cause a...

CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system. Recent assessments: Assessed Attacker...

PT-2025-20812

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The Metadata Uploader function of the Visual Composer tool in SAP NetWeaver contains a flaw in its deserialization mechanism. Deserialization is the process of converting a data stream...

Active exploitation of SAP NetWeaver Visual Composer CVE-2025-31324

On Thursday, April 24, enterprise resource planning company SAP published a CVE and a day later, an advisory behind login for CVE-2025-31324, a zero-day vulnerability in NetWeaver Visual Composer that carries a CVSSv3 score of 10. The vulnerability arises from a missing authorization check in...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

CVE-2025-31324 CVE-2025-31324, SAP Exploit POST /developme...

VulnCheck KEV: CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content...

CVE-2025-31324

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...